Most recent entries from all

certfr-2024-avi-0236 — Une vulnérabilité a été découverte dans les produits Spring Authorization Server. Elle perm…

certfr-2024-avi-0236

EUVD-2026-206262

fkie_cve-2024-22258

Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.

Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.

An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.

GHSA-x637-x8p3-5p22 — Improper Authentication in Spring Authorization Server

Affected: Maven: org.springframework.security:spring-security-oauth2-authorization-server

Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients.

Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant.

An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.

gsd-2024-22258

UBUNTU-CVE-2024-22258

Affected: Ubuntu:16.04:LTS: spring, Ubuntu:18.04:LTS: spring, Ubuntu:20.04:LTS: spring, Ubuntu:22.04:LTS: spring, Ubuntu:24.04:LTS: spring, Ubuntu:25.10: spring, Ubuntu:26.04:LTS: spring

Spring Authorization Server versions 1.0.0 - 1.0.5, 1.1.0 - 1.1.5, 1.2.0 - 1.2.2 and older unsupported versions are susceptible to a PKCE Downgrade Attack for Confidential Clients. Specifically, an application is vulnerable when a Confidential Client uses PKCE for the Authorization Code Grant. An application is not vulnerable when a Public Client uses PKCE for the Authorization Code Grant.