Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2026-22751 · ADVISORY
• spring-projects/spring-security commit 1637727 · WEB
• spring-projects/spring-security commit 4187af3 · WEB
• spring-projects/spring-security · PACKAGE
• jinyeong.seol.pro/blogs/cve-2026-22751/en · WEB
• spring.io/security/cve-2026-22751 · WEB

org.springframework.security:spring-security-core のその他の脆弱性

• CVE-2026-22746低 3.7Vulnerability in Spring Spring Security. If an application is using the UserDetails#isEnabled, #isAccountNonExpired, or #isAccountNonLocked …
• CVE-2025-22234中 5.3The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow …
• CVE-2025-41248高 7.5The Spring Security annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameter…
• CVE-2025-41232緊急 9.1Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Yo…
• CVE-2025-22223中 5.3Spring Security 6.4.0 - 6.4.3 may not correctly locate method security annotations on parameterized types or methods. This may cause an auth…