Executive brief
Spring Security, a framework used to secure Java-based web applications, contains a flaw in its one-time token login feature. When configured to store tokens in a database, a timing issue allows an attacker to potentially use a single-use token multiple times if requests are sent simultaneously. This could lead to unauthorized access or multiple active sessions using a credential that should have expired after one use.
Technical details
A Time-of-check Time-of-use (TOCTOU) race condition exists in Spring Security's JdbcOneTimeTokenService. The vulnerability occurs because the service does not properly validate the database deletion result during the token consumption process in a concurrent environment. A remote attacker can exploit this by sending simultaneous authentication requests using the same one-time token (OTT). If successful, this allows the attacker to bypass the single-use restriction and establish multiple authenticated sessions. The issue is resolved in versions 6.5.10 and 7.0.5.
Affected products
- Spring Spring Security Core 6.4.0 to 6.4.15, 6.5.0 to 6.5.9, 7.0.0 to 7.0.4
Timeline
- 2026-04-21: disclosed
- 2026-04-21: advisory