The vulnerability in Spring Security concerns the configuration of JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder. Applications must explicitly configure an OAuth2TokenValidator<Jwt> to ensure proper validation of JWT tokens. Failure to do so may result in acceptance of invalid or malicious tokens. This affects multiple Spring Security versions from 6.3.0 up to 7.0.4. The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation level has been provided as of the published date.

The vulnerability can lead to improper validation of JWT tokens, potentially allowing attackers to bypass intended security controls related to token integrity and authorization. This impacts the integrity of the application but does not affect confidentiality or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, ensure that applications explicitly configure an OAuth2TokenValidator<Jwt> when using NimbusJwtDecoder or NimbusReactiveJwtDecoder to enforce proper JWT validation. Review application configurations to verify that setJwtValidator or equivalent validation mechanisms are properly implemented.