{
  "@id": "urn:uuid:2446e656-49a0-49da-b8af-787a5c442339",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-10T04:13:00.045658+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-03T12:50:11.363618+00:00",
      "status_notes": "Vulnerability CVE-2024-22258 does not affect version 1.3.7-tuxcare.7 of org.springframework.security:spring-security-oauth2-authorization-server. not_affected \u2014 The target repository (spring-authorization-server 1.3.7-tuxcare.9) is NOT vulnerable to CVE-2024-22258. The upstream fix by Joe Grandja (commit a7035d22) was already present in upstream version 1.3.7 when TuxCare onboarded it. The fix adds validation in CodeVerifierAuthenticator.java that rejects token exchange requests where a code_verifier is provided but no code_challenge was registered dur...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22258"
      },
      "impact_statement": "not_affected \u2014 The target repository (spring-authorization-server 1.3.7-tuxcare.9) is NOT vulnerable to CVE-2024-22258. The upstream fix by Joe Grandja (commit a7035d22) was already present in upstream version 1.3.7 when TuxCare onboarded it. The fix adds validation in CodeVerifierAuthenticator.java that rejects token exchange requests where a code_verifier is provided but no code_challenge was registered dur..."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-06T11:49:00.222150+00:00",
      "status_notes": "Vulnerability CVE-2026-22752 is fixed in version 1.3.7-tuxcare.7 of org.springframework.security:spring-security-oauth2-authorization-server.",
      "vulnerability": {
        "name": "CVE-2026-22752"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-06T11:49:00.222150+00:00",
      "status_notes": "Vulnerability CVE-2026-41008 does not affect version 1.3.7-tuxcare.7 of org.springframework.security:spring-security-oauth2-authorization-server. not_affected \u2014 CVE-2026-41008 affects Spring Authorization Server 1.5.0-1.5.7 due to insufficient validation of the request_uri parameter leading to open redirect. The target version 1.3.7 does not implement request_uri handling at all - this feature was introduced in version 1.5.0. Exhaustive search of the codebase found no extraction, validation, or processing of the request_uri parameter. The vulnerable co...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41008"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-41008 affects Spring Authorization Server 1.5.0-1.5.7 due to insufficient validation of the request_uri parameter leading to open redirect. The target version 1.3.7 does not implement request_uri handling at all - this feature was introduced in version 1.5.0. Exhaustive search of the codebase found no extraction, validation, or processing of the request_uri parameter. The vulnerable co..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2026-47877 affects version 1.3.7-tuxcare.7 of org.springframework.security:spring-security-oauth2-authorization-server.",
      "vulnerability": {
        "name": "CVE-2026-47877"
      },
      "action_statement": "Vulnerability CVE-2026-47877 affects version 1.3.7-tuxcare.7 of org.springframework.security:spring-security-oauth2-authorization-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2026-59316 affects version 1.3.7-tuxcare.7 of org.springframework.security:spring-security-oauth2-authorization-server.",
      "vulnerability": {
        "name": "CVE-2026-59316"
      },
      "action_statement": "Vulnerability CVE-2026-59316 affects version 1.3.7-tuxcare.7 of org.springframework.security:spring-security-oauth2-authorization-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-10-28T18:36:42.887038+00:00",
      "status_notes": "Vulnerability CVE-2026-59354 affects version 1.3.7-tuxcare.7 of org.springframework.security:spring-security-oauth2-authorization-server.",
      "vulnerability": {
        "name": "CVE-2026-59354"
      },
      "action_statement": "Vulnerability CVE-2026-59354 affects version 1.3.7-tuxcare.7 of org.springframework.security:spring-security-oauth2-authorization-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.3.7-tuxcare.7"
          }
        }
      ],
      "timestamp": "2026-11-10T04:13:00.045658+00:00",
      "status_notes": "Vulnerability CVE-2026-59355 does not affect version 1.3.7-tuxcare.7 of org.springframework.security:spring-security-oauth2-authorization-server. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it has no request_uri processing branch that could trigger the vulnerable redirect. The converter treats request_uri only as a generic additional parameter (oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationCodeRequestAuthenticationConverter.java:134).",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-59355"
      },
      "impact_statement": "Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it has no request_uri processing branch that could trigger the vulnerable redirect. The converter treats request_uri only as a generic additional parameter (oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/web/authentication/OAuth2AuthorizationCodeRequestAuthenticationConverter.java:134)."
    }
  ]
}