CVE-2026-22748: 
Java vulnerability analysis and mitigation

CVE-2026-22748 is a security misconfiguration vulnerability in Spring Security titled "Potential Security Misconfiguration when Using withIssuerLocation." When an application configures JWT decoding using NimbusJwtDecoder or NimbusReactiveJwtDecoder with the withIssuerLocation factory method, it may fail to automatically configure an OAuth2TokenValidator<Jwt>, leaving JWT tokens without proper issuer validation. The vulnerability affects Spring Security versions 6.3.0–6.3.14, 6.4.0–6.4.14, 6.5.0–6.5.9, and 7.0.0–7.0.4. It was disclosed on April 20, 2026, and published to the NVD on April 22, 2026. The CVSS v3.1 base score is 5.3–6.5 (Medium/High, depending on scoring authority), with the GitHub Advisory Database assigning a Moderate severity score of 5.3 (Spring Advisory, GitHub Advisory).

The root cause is classified as CWE-20 (Improper Input Validation) — specifically, the withIssuerLocation builder method in NimbusJwtDecoder and NimbusReactiveJwtDecoder does not automatically add issuer validation to the JWT decoder, contrary to what developers may reasonably expect from its name. As a result, applications using this configuration pattern omit the required setJwtValidator() call, leaving JWT tokens accepted without verifying the iss (issuer) claim. An authenticated, low-privileged network attacker can exploit this misconfiguration by presenting JWTs with a manipulated or unexpected issuer claim that would otherwise be rejected. The vulnerability requires high attack complexity (the attacker must be able to craft or obtain a JWT with a different issuer) and no user interaction (Spring Advisory, GitHub Advisory).

Successful exploitation allows an attacker to bypass issuer-based JWT validation, potentially enabling privilege escalation or authentication bypass in applications relying on Spring Security's JWT decoding. The impact is limited to integrity — there is no confidentiality or availability impact — but a compromised JWT validation chain could allow an attacker to impersonate users or access resources they are not authorized to reach. IBM products including watsonx.data and IBM Library Support for Spring are also affected, broadening the scope beyond standalone Spring Security deployments (Spring Advisory, IBM Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is approximately 0.029–0.075%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a low-privileged attacker with network access and high attack complexity, limiting the practical risk compared to unauthenticated or low-complexity vulnerabilities (GitHub Advisory).

1. Identify a vulnerable target: Locate a Spring Security application (versions 6.3.0–6.3.14, 6.4.0–6.4.14, 6.5.0–6.5.9, or 7.0.0–7.0.4) that uses NimbusJwtDecoder.withIssuerLocation() or NimbusReactiveJwtDecoder.withIssuerLocation() without explicitly calling setJwtValidator() to add issuer validation.
2. Obtain a valid JWT: Acquire a legitimate JWT from a different issuer (e.g., a different OAuth2 authorization server or a self-signed token) that would normally be rejected due to an issuer mismatch.
3. Craft a manipulated JWT: Modify the iss (issuer) claim in the JWT payload to match or differ from the expected issuer, depending on the application's trust model and the absence of issuer validation.
4. Submit the JWT: Send an authenticated API request to the target application using the crafted JWT in the Authorization: Bearer header.
5. Achieve unauthorized access: Because the application does not validate the issuer claim, the JWT is accepted, potentially granting access to resources or roles associated with the token's claims beyond what the attacker is legitimately authorized to access (Spring Advisory, GitHub Advisory).

• Logs: Application logs showing successful JWT authentication from unexpected or mismatched issuers; absence of issuer validation errors in Spring Security debug logs where they would be expected.
• Network: API requests bearing JWTs with iss claims that do not match the configured authorization server's issuer URI.
• Application Behavior: Authenticated sessions or resource access originating from tokens issued by untrusted or unexpected OAuth2 providers without corresponding rejection events in security audit logs.

Upgrade Spring Security to the patched versions: 6.3.15 (Enterprise Support only), 6.4.15 (Enterprise Support only), 6.5.10 (OSS), or 7.0.5 (OSS). These versions add issuer validation by default when using withIssuerLocation. If the upgrade introduces unwanted issuer validation, revert to the previous behavior by explicitly calling jwtDecoder.setOAuth2TokenValidator(JwtValidators.createDefaults()) after building the decoder. IBM customers using watsonx.data or IBM Library Support for Spring should apply the relevant IBM security bulletins. As a general best practice, always explicitly configure OAuth2TokenValidator<Jwt> when setting up JWT decoders, regardless of the factory method used (Spring Advisory, IBM Advisory).

The vulnerability was identified and responsibly disclosed by Daniel Seiler, as credited in the Spring Security advisory. HeroDevs published a blog post covering this CVE as part of a broader analysis of Spring Security's April 2026 security releases, which included seven CVEs. Community discussion was observed on Bluesky and via CVE notification feeds shortly after disclosure. The vulnerability was rated "Moderate" by the GitHub Advisory Database, reflecting its limited exploitability despite the integrity impact (Spring Advisory, HeroDevs Blog).