GHSA-h9v6-4cv4-ghhq · Severity: critical — Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization...
Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.
Conclusion & alert: CVE-2026-22752 is rated Moderate Risk (50.4/100): CVSS Critical severity, with low exploitation likelihood (EPSS 0.43%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-07-17 | 0.49% | 0.43% | -0.07% |
| 2 | 2026-07-16 | — | 0.49% | — |
Full EPSS history (2 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 9.6 | 3.1 | CRITICAL |
|
3.1 | 5.8 | [email protected] |
GHSA-h9v6-4cv4-ghhq · Severity: critical — Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization...
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| No affected products in dataset. | |||