9.6Kritisch
CVE-2026-22752Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client metadata
Beschreibung
Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.
Schwachstellentyp (CWE):
CWE-287
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| broadcom | spring authorization server | 1.3.0 – < 1.3.11 | |
| Spring Security | Spring Authorization Server | 7.0.0 – ≤ 7.0.4, 1.5.0 – ≤ 1.5.6, 1.4.0 – ≤ 1.4.9, 1.3.0 – ≤ 1.3.10 |
Referenzen und Patches
- https://spring.io/security/cve-2026-22752 Vendor Advisory
CPE-Treffer (NVD) (3)
cpe:2.3:a:broadcom:spring_authorization_server:*:*:*:*:*:*:*:*≥ 1.3.0 < 1.3.11cpe:2.3:a:broadcom:spring_authorization_server:*:*:*:*:*:*:*:*≥ 1.4.0 < 1.4.10cpe:2.3:a:broadcom:spring_authorization_server:*:*:*:*:*:*:*:*≥ 1.5.0 < 1.5.7