Back
CVE-2018-15801
Authorization Bypass During JWT Issuer Validation with spring-security
Low3.3EPSS 0.65%
- Published
- Updated
- Reserved
- Assigned by
- dell
Description
Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issuer.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| dellCNA (assigner) | 3.0 | Low3.3 | CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N |
| NVDNVD · Modified | 3.1 | High7.4 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N |
- EPSS (exploitation in 30 days)
- 0.65% · top 49% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.3.
Weakness
- Business Logic Errors
- CWE-345 (opens in a new tab)All about CWE-345 and its CVEs
Affected products
Spring by Pivotal · Spring Security
- affected 5.1.x – < 5.1.2
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.springframework.security:spring-security-coreGHSA-27xw-p8v6-9jjr (opens in a new tab)
- Mavenorg.springframework.security:spring-security-oauth2-joseGHSA-27xw-p8v6-9jjr (opens in a new tab)
References (1)
- https://pivotal.io/security/cve-2018-15801 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-27xw-p8v6-9jjr (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2018-15801)Record last updated .