Potential Security Misconfiguration when Using withIssuerLocation

MEDIUM | APRIL 20, 2026 | CVE-2026-22748

Description

When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<Jwt> separately, for example by calling setJwtValidator.

This is easy to miss when using NimbusJwtDecoder#withIssuerLocation or NimbusReactiveJwtDecoder#withIssuerLocation, which may be interpreted as adding issuer validation automatically.

Recent maintenance versions of NimbusJwtDecoder#withIssuerLocation and NimbusReactiveJwtDecoder#withIssuerLocation now add issuer validation by default.

Affected Spring Products and Versions

Spring Security:

7.0.0 - 7.0.4
6.5.0 - 6.5.9
6.4.0 - 6.4.14
6.3.14 and earlier

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Fix version	Availability
7.0.5	OSS
6.5.10	OSS
6.4.15	Enterprise Support Only
6.3.15	Enterprise Support Only

Note that if this upgrade causes you trouble due to unwanted issuer validation, you can change it to the earlier default in the following way:

@Bean
JwtDecoder jwtDecoder() {
    String issuer = "https://issuer.example.org";
    NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withIssuerLocation(issuer)
        // ... other configurations
        .build();
    jwtDecoder.setOAuth2TokenValidator(JwtValidators.createDefaults()); // set to the non-issuer default validator
    return jwtDecoder;
}