CVE-2018-15758: Privilege Escalation Vulnerability in org.springframework.security.oauth:spring-security-oauth2

org.springframework.security.oauth:spring-security-oauth2 Updated 02 Oct 2025

Summary

19/10/2018

Disclosed on

CVE-2018-15758

CVE

Yes i

Fix available

High

Severity

8.1

CVSS Score

CVE-2018-15758: Authorization bypass in org.springframework.security.oauth:spring-security-oauth2. Affects org.springframework.security.oauth:spring-security-oauth2 across 4 version ranges.

>= 2.0.0, < 2.0.16 >= 2.1.0, < 2.1.3 >= 2.2.0, < 2.2.3.RELEASE >= 2.3.0, < 2.3.4.RELEASE

Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

org.springframework.security.oauth:spring-security-oauth2 is a Maven package that provides OAuth 2.0 support for Spring Security. It allows developers to implement OAuth 2.0 authorization servers, resource servers, and clients in their applications. This package is widely used in Java applications that require secure authentication and authorization mechanisms.

Vulnerability Detail

The vulnerability, identified as CVE-2018-15758, is a high severity privilege escalation issue in org.springframework.security.oauth:spring-security-oauth2. Versions 2.0.0 to 2.0.16, 2.1.0 to 2.1.3, 2.2.0 to 2.2.3, and 2.3.0 to 2.3.4 are affected. Under certain conditions, a malicious user or attacker can manipulate a request to the approval endpoint, modifying a previously saved authorization request and leading to privilege escalation during subsequent approval. This vulnerability exposes applications that act as an Authorization Server and use a custom Approval Endpoint with AuthorizationRequest as a controller method argument.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

>= 2.0.0, < 2.0.16 2.0.16
>= 2.1.0, < 2.1.3 2.1.3
>= 2.2.0, < 2.2.3.RELEASE 2.2.3.RELEASE
>= 2.3.0, < 2.3.4.RELEASE 2.3.4.RELEASE

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no known workaround for this vulnerability. Upgrading to the patched version is the only solution.

Conclusion

The privilege escalation vulnerability in org.springframework.security.oauth:spring-security-oauth2 can lead to unauthorized privilege escalation in applications acting as an Authorization Server with a custom Approval Endpoint. It is crucial to upgrade to the latest patched version (2.0.16, 2.1.3, 2.2.3, or 2.3.4) to mitigate this vulnerability. Regularly updating the package and staying informed about security advisories is essential to ensure the security of your application.

See every vulnerability recorded for org.springframework.security.oauth:spring-security-oauth2 →

FAQ

How can I check if my application is affected by this vulnerability?

You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities, including this one, are found.

Can I mitigate the risk by disabling the custom Approval Endpoint?

Disabling the custom Approval Endpoint will prevent the privilege escalation vulnerability. However, this may impact the functionality of your application, especially if it relies on custom approval logic. It is recommended to upgrade to the patched version instead.