{"action":"Upgrade org.springframework.security:spring-security-oauth2-jose to 6.5.10 (6.x) or 7.0.5 (7.x) or later.","affected":[{"introduced":"6.3.0","last_affected":"6.3.14"},{"introduced":"6.4.0","last_affected":"6.4.14"},{"fixed":"6.5.10","introduced":"6.5.0"},{"fixed":"7.0.5","introduced":"7.0.0"}],"component":"org.springframework.security:spring-security-oauth2-jose","cve_ids":["CVE-2026-22748"],"ecosystem":"Maven","epss":0.00203,"exploited":false,"fixed_versions":["6.5.10","7.0.5"],"ghsa_id":"GHSA-cvc6-q2cp-2xhw","id":"tcs_01M5N8TB48JXCTC516KYTBQMC4","modified_at":"2026-09-10T03:50:44.128453900Z","published_at":"2026-04-22T06:30:29Z","references":["https://osv.dev/vulnerability/GHSA-cvc6-q2cp-2xhw","https://nvd.nist.gov/vuln/detail/CVE-2026-22748","https://github.com/spring-projects/spring-security","https://spring.io/security/cve-2026-22748"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-cvc6-q2cp-2xhw","url":"https://osv.dev/vulnerability/GHSA-cvc6-q2cp-2xhw"}],"summary":"Spring Security has Potential Security Misconfiguration when Using withIssuerLocation"}