This vulnerability in Spring Security occurs when JWT decoding is configured using NimbusJwtDecoder or NimbusReactiveJwtDecoder without separately setting an OAuth2TokenValidator<Jwt>. Without this validator, JWT tokens may not be properly validated, which can lead to integrity issues in token processing. Affected versions include Spring Security 6.3.0 through 6.3.14, 6.4.0 through 6.4.14, 6.5.0 through 6.5.9, and 7.0.0 through 7.0.4. The CVSS score of 5.3 reflects a medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and an impact on integrity only. No official remediation or patch information is provided in the available data.

The vulnerability can lead to integrity violations in JWT token validation, potentially allowing attackers to bypass or manipulate token validation logic. This could result in unauthorized actions or access if the application relies on JWT tokens for security decisions. There is no indication of confidentiality or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix or guidance is available, ensure that applications explicitly configure an OAuth2TokenValidator<Jwt> when using NimbusJwtDecoder or NimbusReactiveJwtDecoder to enforce proper JWT validation. Review application configurations to verify that setJwtValidator or equivalent validation is properly implemented.