9.6Kritik
CVE-2026-22752Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client metadata
Açıklama
Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.
Zayıflık türü (CWE):
CWE-287
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| broadcom | spring authorization server | 1.3.0 – < 1.3.11 | |
| Spring Security | Spring Authorization Server | 7.0.0 – ≤ 7.0.4, 1.5.0 – ≤ 1.5.6, 1.4.0 – ≤ 1.4.9, 1.3.0 – ≤ 1.3.10 |
Kaynaklar ve yamalar
- https://spring.io/security/cve-2026-22752 Vendor Advisory
CPE eşleşmeleri (NVD) (3)
cpe:2.3:a:broadcom:spring_authorization_server:*:*:*:*:*:*:*:*≥ 1.3.0 < 1.3.11cpe:2.3:a:broadcom:spring_authorization_server:*:*:*:*:*:*:*:*≥ 1.4.0 < 1.4.10cpe:2.3:a:broadcom:spring_authorization_server:*:*:*:*:*:*:*:*≥ 1.5.0 < 1.5.7