by Kastro
Paper/Archive/CVE-2026-22752

CVE-2026-22752

Spring Security Spring Authorization Server — Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client metadata

EPSS 0.5%CVSS 9.6
critical.is priorityof 100
37
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 41.3.413 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.

Affected

ProductAffectedFixed inSource
Spring Authorization Server7.0.0 – 7.0.4–CNA
Spring Authorization Server1.5.0 – 1.5.6–CNA
Spring Authorization Server1.4.0 – 1.4.9–CNA
Spring Authorization Server1.3.0 – 1.3.10–CNA

Scores by source

vmware (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refspring.io/security/cve-2026-22752