CVE-2018-15801

score

<0.1

cvss

7.4

epss

0.7%

published

2018-12-19

kev added

—

first seen

2026-10-21

Spring Security 5.1.x prior to 5.1.2 contains an authorization bypass caused by flawed JWT issuer validation, letting malicious users craft signed JWTs with malicious issuer URLs that may be granted for the honest issuer, exploit requires using the same private key for honest and malicious issuer.