Skip to content
Fencer Vulns
low 3.3

CVE-2018-15801 json

Authorization Bypass During JWT Issuer Validation with spring-security

published 2018-12-19 7 y ago modified 2026-06-17 4 mo ago also GHSA-27xw-p8v6-9jjr , EUVD-2018-0791

cvss
3.3
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 51%
public exploits
0
none known

Summary

Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issuer.

Patch / fix

  • maven org.springframework.security:spring-security-core 5.1.2
  • maven org.springframework.security:spring-security-oauth2-jose 5.1.2
  • Spring by Pivotal Spring Security 5.1.2

Exploit prediction

0.65% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 3.3 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
NVD 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub 3.0 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
maven org.springframework.security:spring-security-core
>=5.1.0, <5.1.2
5.1.2
maven org.springframework.security:spring-security-oauth2-jose
>=5.1.0, <5.1.2
5.1.2

Affected products

  • Spring by Pivotal Spring Security

Classification

Weakness
  • CWE-345 Insufficient Verification of Data Authenticity
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.