CVE-2026-22748 Spring Security JWT验证绕过漏洞

// Vulnerable Configuration Example (Conceptual) // The developer creates a decoder but forgets to set the validator NimbusJwtDecoder decoder = NimbusJwtDecoder.withJwkSetUri("https://auth.example.com/.well-known/jwks.json").build(); // Missing critical security line: decoder.setJwtValidator(new JwtValidator()); // Attack Scenario // 1. Attacker intercepts a valid JWT or creates a new one. // 2. Attacker modifies the payload (e.g., changing "role" to "ADMIN"). // 3. Attacker sends the malicious token to the server: // curl -H "Authorization: Bearer <malicious_jwt>" https://target.com/admin // 4. Server accepts the token because the validator is missing.