VulnerableCode Package Details - pkg:maven/org.springframework.security/spring-security-oauth2-client@5.4.0

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:maven/org.springframework.security/spring-security-oauth2-client@5.4.0

Essentials
History (2)

purl	pkg:maven/org.springframework.security/spring-security-oauth2-client@5.4.0

Next non-vulnerable version	5.6.9
Latest non-vulnerable version	5.7.5
Risk	4.0

Vulnerabilities affecting this package (2)

Vulnerability	Summary	Fixed by
VCID-93wt-cm81-dqbh Aliases: CVE-2021-22119 GHSA-w9jg-gvgr-354m		5.4.7 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 5.5.1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-9jd9-sy72-d3bk Aliases: CVE-2022-31690 GHSA-32vj-v39g-jh23	Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the browser) to the Authorization Server which can lead to a privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1) on the subsequent request to the token endpoint to obtain the access token.	5.6.9 Affected by 0 other vulnerabilities. 5.7.5 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-93wt-cm81-dqbh
Aliases:
CVE-2021-22119
GHSA-w9jg-gvgr-354m

5.4.7
Affected by 1 other vulnerability.

5.5.1
Affected by 1 other vulnerability.

VCID-9jd9-sy72-d3bk
Aliases:
CVE-2022-31690
GHSA-32vj-v39g-jh23

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the browser) to the Authorization Server which can lead to a privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1) on the subsequent request to the token endpoint to obtain the access token.

5.6.9
Affected by 0 other vulnerabilities.

5.7.5
Affected by 0 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-13T06:23:45.353771+00:00	GHSA Importer	Affected by	VCID-93wt-cm81-dqbh	https://github.com/advisories/GHSA-w9jg-gvgr-354m	38.6.0
2026-06-12T18:38:21.825848+00:00	GitLab Importer	Affected by	VCID-9jd9-sy72-d3bk	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.springframework.security/spring-security-oauth2-client/CVE-2022-31690.yml	38.6.0