CVE-2026-22751: 
Java vulnerability analysis and mitigation

CVE-2026-22751 is a Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Spring Security's JdbcOneTimeTokenService that allows a valid one-time token to authenticate multiple concurrent sessions. It affects Spring Security versions 6.4.0–6.4.15, 6.5.0–6.5.9, and 7.0.0–7.0.4. The vulnerability was disclosed on April 21, 2026, and carries a CVSS v3.1 base score of 4.8 (Medium) (Spring Advisory). IBM products including Library Support for Spring, Business Automation Manager Open Editions, and Sterling Connect:Direct Web Services are also affected as downstream consumers (IBM Advisory).

The root cause is a TOCTOU race condition (CWE-367) in the JdbcOneTimeTokenService implementation used for One-Time Token (OTT) login in Spring Security. When an attacker possesses a valid one-time token, they can send multiple concurrent HTTP requests to the authentication endpoint before the token is marked as consumed in the database, allowing the single-use token to be reused across multiple sessions. This vulnerability only affects applications that explicitly configure OTT login using JdbcOneTimeTokenService; the default InMemoryOneTimeTokenService is thread-safe and not susceptible. No authentication is required to trigger the race condition beyond possession of a valid token, and no user interaction is needed (Spring Advisory).

Successful exploitation allows an attacker who has obtained a valid one-time token to establish multiple authenticated sessions simultaneously, violating the single-use guarantee of the OTT mechanism. This results in limited confidentiality and integrity impacts — an attacker could gain unauthorized access to application resources accessible to the token's associated user account. Availability is not impacted, and the scope is unchanged, meaning exploitation is confined to the vulnerable application's security boundary (Spring Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of this report. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the attacker to first obtain a valid one-time token (e.g., through interception or social engineering) and then race concurrent requests against the authentication endpoint, making opportunistic exploitation difficult (Spring Advisory).

1. Obtain a valid one-time token: Acquire a legitimate OTT issued by the target application, either by intercepting a token delivery channel (e.g., email or SMS) or through social engineering.
2. Identify the authentication endpoint: Locate the OTT authentication endpoint configured in the Spring Security application (typically a POST endpoint such as /login/ott or similar).
3. Send concurrent requests: Using a tool such as curl, Burp Suite Intruder, or a custom script, send multiple simultaneous HTTP POST requests to the authentication endpoint with the same one-time token before the first request completes and marks the token as consumed.
4. Establish multiple sessions: If the race condition is won, multiple authenticated session cookies are returned — each valid for the user account associated with the token — granting the attacker unauthorized access to the application (Spring Advisory).

• Logs: Multiple successful authentication events for the same one-time token within a very short time window (milliseconds apart) in application authentication logs; duplicate session creation events for the same user account in rapid succession.
• Network: Burst of concurrent POST requests to the OTT authentication endpoint (e.g., /login/ott) from the same or similar source IP addresses within a narrow time window.
• Application Behavior: Multiple active authenticated sessions for the same user account created at nearly identical timestamps, which is anomalous for OTT-based login flows.

Users should upgrade Spring Security to the corresponding fixed versions: 6.4.16 (commercial support), 6.5.10 (OSS), or 7.0.5 (OSS). No configuration-based workaround is documented; however, applications not using JdbcOneTimeTokenService (i.e., those using the default InMemoryOneTimeTokenService) are not affected and require no action. IBM customers using affected products should apply the patches referenced in the respective IBM security bulletins (Spring Advisory, IBM Advisory, IBM Sterling Bulletin).

The vulnerability was responsibly disclosed by security researcher Jinyeong Seol (@Seol-JY) and acknowledged by the Spring Security team (Spring Advisory). HeroDevs covered the vulnerability as part of a broader analysis of Spring Security's April 2026 CVE batch, noting it alongside more severe authorization bypass issues (HeroDevs Blog). General community reaction has been measured given the Medium severity rating and the narrow exploitation preconditions.