CVE-2026-22751 — Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions

CVE-2026-22751

Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions PUBLISHED

Description (CNA)

Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

Affected (CNA)

Vendor / product	Versions
Spring / Spring Security	affected 6.4.0 through 6.4.15; affected 6.5.0 through 6.5.9; affected 7.0.0 through 7.0.4

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-22751

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.