Description

Applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService are vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. An attacker with a valid one-time token can send concurrent requests to the authentication endpoint, allowing the single-use token to be consumed multiple times and establishing multiple authenticated sessions. The default InMemoryOneTimeTokenService is thread-safe and not affected by this vulnerability.

Affected Spring Products and Versions

Spring Security:

• 6.4.0 - 6.4.15
• 6.5.0 - 6.5.9
• 7.0.0 - 7.0.4

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Credit

The issue was identified and responsibly reported by Jinyeong Seol (@Seol-JY).

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N&version=3.1