CVE-2026-22752

—

CVSS 3.1

9.6 critical

EPSS

<1%p40

Published

Jul 16, 2026 (Jul 16, 2026)

Modified

Sep 4, 2026

Description

Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.

Vendors: broadcom
Products: spring authorization server
Weakness: CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.