Spring Security OAuth2 Authentication Bypass via setAccessToken with POC

Vulnerability Overview This vulnerability affects the class within the library. Under specific configurations, an attacker can craft malicious requests to exploit the method of this class, bypassing the OAuth2 authentication flow. This allows the direct setting of an access token, thereby granting unauthorized access. Scope of Impact Affected Component: Affected Versions: All versions (as of the time of the screenshot) Affected Method: Remediation 1. Upgrade Library Version: Upgrade to the latest version of the library to obtain the official patch. 2. Custom Implementation: If an immediate upgrade is not feasible, implement a custom version of to ensure the method cannot be invoked externally or to enforce additional validation. 3. Configuration Restrictions: Restrict access to in the application configuration to ensure that only trusted code can invoke the method. POC Code ```java import org.springframework.security.oauth2.client.OAuth2RestTemplate; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsResourceDetails; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenGranter; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequest; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponse; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenResponseExtractor; import org.springframework.security.oauth2.client.token.grant.client.ClientCredentialsTokenRequestExtractor; import org.springf

Goal Reached Thanks to every supporter — we hit 100%!

Spring Security OAuth2 Authentication Bypass via setAccessToken with POC

More from this source