{
  "@id": "urn:uuid:008469ab-5e89-4ae7-b7cc-f0ef60dbae44",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 7,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:13:00.045658+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:50:11.363618+00:00",
      "status_notes": "Vulnerability CVE-2024-22258 does not affect version 1.3.6-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server. not_affected \u2014 CVE-2024-22258 (PKCE Downgrade Attack for Confidential Clients) is NOT present in Spring Authorization Server 1.3.6. The upstream fix (commit a7035d22) was already included in the 1.3.6 release when TuxCare onboarded it. The vulnerable code pattern where confidential clients could bypass PKCE validation has been patched. The fix adds validation to reject token requests that provide code_verifie...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22258"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-22258 (PKCE Downgrade Attack for Confidential Clients) is NOT present in Spring Authorization Server 1.3.6. The upstream fix (commit a7035d22) was already included in the 1.3.6 release when TuxCare onboarded it. The vulnerable code pattern where confidential clients could bypass PKCE validation has been patched. The fix adds validation to reject token requests that provide code_verifie..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T05:28:00.100847+00:00",
      "status_notes": "Vulnerability CVE-2026-22752 is fixed in version 1.3.6-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server.",
      "vulnerability": {
        "name": "CVE-2026-22752"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T05:26:00.137369+00:00",
      "status_notes": "Vulnerability CVE-2026-41008 does not affect version 1.3.6-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server. not_affected \u2014 Target version 1.3.6 is NOT AFFECTED by CVE-2026-41008. The vulnerability requires request_uri parameter support (RFC 9126 Pushed Authorization Requests), which was introduced in Spring Authorization Server 1.5.0. Version 1.3.6 does not process request_uri parameters at all - the OAuth2AuthorizationCodeRequestAuthenticationConverter has no requestUri variable extraction, no PAR-related classes ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41008"
      },
      "impact_statement": "not_affected \u2014 Target version 1.3.6 is NOT AFFECTED by CVE-2026-41008. The vulnerability requires request_uri parameter support (RFC 9126 Pushed Authorization Requests), which was introduced in Spring Authorization Server 1.5.0. Version 1.3.6 does not process request_uri parameters at all - the OAuth2AuthorizationCodeRequestAuthenticationConverter has no requestUri variable extraction, no PAR-related classes ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2026-47877 affects version 1.3.6-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server.",
      "vulnerability": {
        "name": "CVE-2026-47877"
      },
      "action_statement": "Vulnerability CVE-2026-47877 affects version 1.3.6-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2026-59316 affects version 1.3.6-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server.",
      "vulnerability": {
        "name": "CVE-2026-59316"
      },
      "action_statement": "Vulnerability CVE-2026-59316 affects version 1.3.6-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-59354 affects version 1.3.6-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server.",
      "vulnerability": {
        "name": "CVE-2026-59354"
      },
      "action_statement": "Vulnerability CVE-2026-59354 affects version 1.3.6-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.6-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-10T04:13:00.045658+00:00",
      "status_notes": "Vulnerability CVE-2026-59355 does not affect version 1.3.6-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it has no request_uri processing, so the vulnerable error path cannot be reached. Unknown parameters are stored as additionalParameters in web/authentication/OAuth2AuthorizationCodeRequestAuthenticationConverter.java:134. Invalid redirect URIs are cleared in authentication/OAuth2AuthorizationCodeRequestAuthenticationValidator.java:215, and web/OAuth2AuthorizationEndpointFilter.java:364 returns HTTP 400 without redirecting.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59355"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it has no request_uri processing, so the vulnerable error path cannot be reached. Unknown parameters are stored as additionalParameters in web/authentication/OAuth2AuthorizationCodeRequestAuthenticationConverter.java:134. Invalid redirect URIs are cleared in authentication/OAuth2AuthorizationCodeRequestAuthenticationValidator.java:215, and web/OAuth2AuthorizationEndpointFilter.java:364 returns HTTP 400 without redirecting."
    }
  ]
}