Spring Security’s NimbusJwtDecoder and NimbusReactiveJwtDecoder parse JSON Web Tokens but can leave critical checks unperformed unless a developer explicitly configures an OAuth2TokenValidator<Jwt>. When this step is omitted, the library does not enforce signature verification, issuer validation, or expiration checks, allowing a forged or expired token to be accepted and granting unauthorised access. The weakness stems from missing configuration and improper input validation, as reflected by CWE‑20 and CWE‑347, indicating input validation errors and protocol convention violations.

Spring Security versions 6.3.0 through 6.3.14, 6.4.0 through 6.4.14, 6.5.0 through 6.5.9, and 7.0.0 through 7.0.4 are affected. All other releases are not impacted by this misconfiguration.

The CVSS score of 5.3 indicates medium severity, while the EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in the KEV catalog, further indicating limited public exploitation. The likely attack vector involves an attacker who can influence application configuration—typically a developer or system administrator—so the risk is higher in environments where such access is possible, rather than from a remote attacker without deployment privileges.