Spring Security allows developers to configure JWT decoding using NimbusJwtDecoder or NimbusReactiveJwtDecoder. However, if an application forgets to configure an OAuth2TokenValidator<Jwt> (such as by calling setJwtValidator) the system will accept any JWT without validating its signature, issuer, or expiration. This misconfiguration can allow an attacker to forge a token and gain unauthorized access to protected resources. The weakness corresponds to missing validation and configuration errors.

Spring Security, versions 6.3.0 through 6.3.14, 6.4.0 through 6.4.14, 6.5.0 through 6.5.9, and 7.0.0 through 7.0.4.

The CVSS score of 5.3 indicates a medium impact. The absence of an EPSS score and non‑listing in KEV suggests this vulnerability has not yet been widely exploited. The attack vector likely requires an ability to modify or deploy application configuration – typically a developer or administrator – to bypass token validation. Until the validator is added or the library is updated, the application remains vulnerable to token forgery and unauthorized access.