CVE-2026-22751: Spring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions
Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22751?
The severity of CVE-2026-22751 is classified as critical due to the potential for multiple sessions to be authenticated with a single one-time token.
How do I fix CVE-2026-22751?
To fix CVE-2026-22751, upgrade your Spring Security version to the latest version that addresses this vulnerability, such as 6.4.16 or newer.
Which versions of Spring Security are affected by CVE-2026-22751?
CVE-2026-22751 affects Spring Security versions 6.4.0 to 6.4.15, 6.5.0 to 6.5.9, and 7.0.0 to 7.0.4.
What causes CVE-2026-22751?
CVE-2026-22751 is caused by a Time-of-check Time-of-use (TOCTOU) race condition in the JdbcOneTimeTokenService implementation.
Is CVE-2026-22751 exploitable in production environments?
Yes, CVE-2026-22751 is exploitable in production environments where applications are configured to use JdbcOneTimeTokenService for one-time token authentication.