Read the docs
TI-2018-11264 Aliases CVE-2018-15801GHSA-27xw-p8v6-9jjr

Authorization Bypass During JWT Issuer Validation with spring-security

Priority LOW 33CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-345.

Summary

Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issuer.

Why it matters now

EPSS 0.00653 51st percentileScored 2026-11-07
Fix Fixed Spring Security (Spring by Pivotal): 5.1.2org.springframework.security:spring-security-core (Maven): 5.1.2+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Spring by PivotalSpring Security5.1.x to before 5.1.25.1.2Patch availableCNA
—org.springframework.security:spring-security-core (Maven)5.1.0 to before 5.1.25.1.2Patch availableGHSA-27xw-p8v6-9jjr
—org.springframework.security:spring-security-oauth2-jose (Maven)5.1.0 to before 5.1.25.1.2Patch availableGHSA-27xw-p8v6-9jjr
  • Spring Security VendorSpring by Pivotal Affected 5.1.x to before 5.1.2 Fixed in 5.1.2 Patch available CNA
  • org.springframework.security:spring-security-core (Maven) Vendor— Affected 5.1.0 to before 5.1.2 Fixed in 5.1.2 Patch available GHSA-27xw-p8v6-9jjr
  • org.springframework.security:spring-security-oauth2-jose (Maven) Vendor— Affected 5.1.0 to before 5.1.2 Fixed in 5.1.2 Patch available GHSA-27xw-p8v6-9jjr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:*5.1.0 to before 5.1.2VulnerableVMware
  • cpe:2.3:a:vmware:spring_framework:*:*:*:*:*:*:*:* Versions 5.1.0 to before 5.1.2 Vulnerable ·VMware

Remediation

  • Fix · CNA Spring Security (Spring by Pivotal) Fixed in 5.1.2
  • Fix · GHSA-27xw-p8v6-9jjr org.springframework.security:spring-security-core (Maven) Fixed in 5.1.2 Advisory →
  • Fix · GHSA-27xw-p8v6-9jjr org.springframework.security:spring-security-oauth2-jose (Maven) Fixed in 5.1.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-15801
  2. 2026-10-03 Alias added: GHSA-27xw-p8v6-9jjr
  3. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Advisory 3

Other 2

  • TI-2018-01178 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-01175 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2017-05637 Improper input validation in Pivotal Spring Data REST and Spring Boot CVSS 3.0CRITICAL 9.8
  • TI-2018-01180 Code injection in Spring Framework CVSS 3.1CRITICAL 9.8
  • TI-2013-05382 The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and… CVSS 2.0MEDIUM 6.8
  • TI-2022-13602 Authorization bypass in Concourse CVSS 3.1MEDIUM 5.4
See all 145 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences