This vulnerability (CVE-2026-22752) in Spring Security Spring Authorization Server allows an attacker with low privileges to bypass authentication mechanisms, resulting in complete compromise of confidentiality and integrity. The issue affects several version ranges: 7.0.0 to 7.0.4, 1.5.0 to 1.5.6, 1.4.0 to 1.4.9, and 1.3.0 to 1.3.10. The CVSS v3.1 score is 9.6 (critical), indicating a network attack vector with low attack complexity, no user interaction, and scope change. The vulnerability is categorized under CWE-287 (Improper Authentication). As of the published date, no official fix or patch is available, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability allows attackers to bypass authentication controls, leading to full compromise of confidentiality and integrity of the affected system. This can enable unauthorized access to protected resources and potentially unauthorized actions within the authorization server environment. Availability impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been published, monitor the Spring Security project advisories for updates. Until a patch is available, consider implementing compensating controls such as restricting network access to the authorization server and increasing monitoring of authentication-related activities.