CVE-2018-1260: Spring Security OAuth Remote Code Execution (RCE)
Summary
CVE-2018-1260: Spring Security OAuth vulnerable to remote code execution (RCE). Affects org.springframework.security.oauth:spring-security-oauth2 across 5 version ranges.
>= 1.0.0, <= 1.0.5
>= 2.0.0, < 2.0.15
>= 2.1.0, < 2.1.2
>= 2.2.0, < 2.2.2
>= 2.3.0, < 2.3.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Spring Security OAuth is a library that provides support for OAuth 2.0 and OpenID Connect (OIDC) protocols in Spring applications. It allows developers to secure their applications by integrating with OAuth providers for authentication and authorization. However, versions prior to 2.3.3, 2.2.2, 2.1.2, and 2.0.15 are vulnerable to remote code execution (RCE). This vulnerability can be exploited by crafting an authorization request to the authorization endpoint, leading to RCE when the resource owner is redirected to the approval endpoint.
Vulnerability Detail
The vulnerability in Spring Security OAuth allows an attacker to execute arbitrary code on the affected system. By manipulating the authorization request, an attacker can inject malicious code that will be executed when the resource owner is redirected to the approval endpoint. This can result in a complete compromise of the system, allowing the attacker to gain unauthorized access, steal sensitive information, or perform other malicious activities.
How To Fix
Latest published version: 2.5.2.RELEASE as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.0.152.0.15 -
>= 2.1.0, < 2.1.22.1.2 -
>= 2.2.0, < 2.2.22.2.2 -
>= 2.3.0, < 2.3.32.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of Spring Security OAuth to mitigate the risk of remote code execution.
Conclusion
The vulnerability in Spring Security OAuth exposes applications to the risk of remote code execution. To protect your application, it is recommended to upgrade to the fixed version of Spring Security OAuth. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.security.oauth:spring-security-oauth2 →
FAQ
Spring Security OAuth is a library that provides support for OAuth 2.0 and OpenID Connect (OIDC) protocols in Spring applications. It allows developers to secure their applications by integrating with OAuth providers for authentication and authorization.
Versions prior to 2.3.3, 2.2.2, 2.1.2, and 2.0.15 are affected by this vulnerability.
An attacker can exploit this vulnerability by crafting an authorization request to the authorization endpoint, injecting malicious code that will be executed when the resource owner is redirected to the approval endpoint.
This vulnerability can lead to remote code execution, allowing an attacker to execute arbitrary code on the affected system. This can result in unauthorized access, data theft, or other malicious activities.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of Spring Security OAuth to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security.oauth:spring-security-oauth2.
