CVE-2026-22752CWE-287

CVE-2026-22752

Critical · published July 16, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
40.3
In the wild
Unconfirmed
What it is

Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server.

This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00479 · 40.3th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-07-16T14:16Z
Affected products (3)
ProductVersionsFixed in
broadcom/spring_authorization_server≥ 1.3.0, < 1.3.111.3.11
broadcom/spring_authorization_server≥ 1.4.0, < 1.4.101.4.10
broadcom/spring_authorization_server≥ 1.5.0, < 1.5.71.5.7
References (1)
https://spring.io/security/cve-2026-22752 · [email protected]
EPSS history
Timeline
  • 16 JUL 08:40Z
    Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client metadata
    cvelistv5