CVE-2026-22751: Spring Spring Security TOCTOU race condition in JdbcOneTimeTokenService

CVE-2026-22751 · Severity: medium · CVSS 4.8 · Published 2026-04-21

Spring Security, a framework used to secure Java-based web applications, contains a flaw in its one-time token login feature. When configured to store tokens in a database, a timing issue allows an attacker to potentially use a single-use token multiple times if requests are sent simultaneously. This could lead to unauthorized access or multiple active sessions using a credential that should have expired after one use.

Technologies: org.springframework.security:spring-security-core (Maven), VMware Spring Security. Vendors: Broadcom, Maven, VMware.

Quick answers

Is CVE-2026-22751 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-22751 being exploited in the wild.
How severe is CVE-2026-22751?
Medium severity, with a CVSS score of 4.8, published 21 April 2026.
Which products and versions are affected?
Broadcom Spring Security Core 6.4.0 to 6.4.15, 6.5.0 to 6.5.9, 7.0.0 to 7.0.4; org.springframework.security:spring-security-core (Maven) ECOSYSTEM:introduced=6.5.0,fixed=6.5.10.
Is there a fix for CVE-2026-22751?
Yes. org.springframework.security:spring-security-core (Maven): upgrade to 6.5.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22751 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-22751?
Check whether you run Broadcom Spring Security Core, org.springframework.security:spring-security-core (Maven) or VMware Spring Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.security:spring-security-core (Maven): upgrade to 6.5.10 or later
    # set org.springframework.security:spring-security-core to 6.5.10 in your pom.xml or build.gradle

Technical details

A Time-of-check Time-of-use (TOCTOU) race condition exists in Spring Security's JdbcOneTimeTokenService. The vulnerability occurs because the service does not properly validate the database deletion result during the token consumption process in a concurrent environment. A remote attacker can exploit this by sending simultaneous authentication requests using the same one-time token (OTT). If successful, this allows the attacker to bypass the single-use restriction and establish multiple authenticated sessions. The issue is resolved in versions 6.5.10 and 7.0.5.

Affected products

  • Spring Spring Security Core 6.4.0 to 6.4.15, 6.5.0 to 6.5.9, 7.0.0 to 7.0.4

Identifiers

  • CVE-2026-22751
  • GHSA-x2wq-9x2f-fhj7

Timeline

  • 2026-04-21: disclosed
  • 2026-04-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.