Recommended action

Update org.springframework.security:spring-security-core to 6.5.10; org.springframework.security:spring-security-core to 7.0.5 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured affects org.springframework.security:spring-security-core (maven), org.springframework.security:spring-security-core (maven), org.springframework.security:spring-security-core (maven). Severity is medium. Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

AI coding agents often install or upgrade packages automatically in maven. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update org.springframework.security:spring-security-core to 6.5.10; org.springframework.security:spring-security-core to 7.0.5 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured affects org.springframework.security:spring-security-core (maven), org.springframework.security:spring-security-core (maven), org.springframework.security:spring-security-core (maven). Severity is medium. Vulnerability in Spring Spring Security. Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. This issue affects Spring Security: from 6.4.0 through 6.4.15, from 6.5.0 through 6.5.9, from 7.0.0 through 7.0.4.

AI coding agents often install or upgrade packages automatically in maven. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software