Package Health/org.springframework.security:spring-security-oauth2-jose

spring-security-oauth2-jose

Spring Security

Latest 7.2.0-M2org.springframework.security

Maven

88%

Total Score

healthy

Healthy overall, supported by frequent releases and active organization-led maintenance; this is a milestone release.

Are you affected? Scan for Free

Health Score Breakdown

Version stability

7.2.0-M2 is a prerelease, so consumers should expect possible API or behavior changes even though the major line is established.

Workflow audit

All 12 workflows were analyzed, references are fully pinned, and no untrusted checkout or script-injection paths were found. High-confidence template injection, several secrets-inherit findings, and four workflows with top-level write permissions are workflow-hygiene concerns, but no dangerous trigger-and-sink combination was reported.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-61483 spring-security-oauth2-jose is vulnerable to Authentication Bypass in versions 6.5.0 - 7.0.6 and 7.1.0 - 7.1.0.	6.5.0 - 7.0.67.1.0 - 7.1.0	High
CVE-2026-22748 org.springframework.security:spring-security-oauth2-jose is vulnerable to Improper Input Validation in versions 6.3.0 - 6.3.14, 6.4.0 - 6.4.14, 6.5.0 - 6.5.9 and 7.0.0 - 7.0.4.	6.3.0 - 6.3.146.4.0 - 6.4.146.5.0 - 6.5.9 +1 more	Medium

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
org.springframework.security:spring-security-core Version 7.2.0-M2	—	—
org.springframework.security:spring-security-oauth2-core Version 7.2.0-M2	—	—
org.springframework:spring-core Version 7.1.0-M2	—	—
com.nimbusds:nimbus-jose-jwt Version 10.9.1	—	—