This vulnerability in Spring Security arises from a TOCTOU race condition when using the JdbcOneTimeTokenService for One-Time Token login. The affected versions are from 6.4.0 through 6.4.15, 6.5.0 through 6.5.9, and 7.0.0 through 7.0.4. The issue could allow an attacker to exploit timing discrepancies between the check and use of tokens, potentially impacting confidentiality and integrity of the authentication process. The CVSS v3.1 base score is 4.8, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and unchanged scope.

The vulnerability may allow an attacker to exploit a race condition in the One-Time Token login mechanism, potentially leading to limited confidentiality and integrity compromise. There is no impact on availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider reviewing the use of JdbcOneTimeTokenService in affected Spring Security versions and evaluate risk accordingly.