{
  "@id": "urn:uuid:45b72418-1ef0-4bbc-a0a4-c3e55bbc9b90",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T17:24:48.875273+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-03T12:50:11.363618+00:00",
      "status_notes": "Vulnerability CVE-2024-22258 does not affect version 1.5.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server. not_affected \u2014 CVE-2024-22258 (PKCE Downgrade Attack for Confidential Clients) is NOT present in spring-authorization-server 1.5.8-tuxcare.3. The upstream fix (commit a7035d22 by Joe Grandja) was already included in the upstream 1.5.8 release when TuxCare onboarded it. The fix adds validation at CodeVerifierAuthenticator.java:101 that rejects token requests providing a code_verifier when no code_challenge was...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-22258"
      },
      "impact_statement": "not_affected \u2014 CVE-2024-22258 (PKCE Downgrade Attack for Confidential Clients) is NOT present in spring-authorization-server 1.5.8-tuxcare.3. The upstream fix (commit a7035d22 by Joe Grandja) was already included in the upstream 1.5.8 release when TuxCare onboarded it. The fix adds validation at CodeVerifierAuthenticator.java:101 that rejects token requests providing a code_verifier when no code_challenge was..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-11-06T17:24:48.875273+00:00",
      "status_notes": "Vulnerability CVE-2026-22752 does not affect version 1.5.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server. Prechecker: The upstream fix is already in this version's source history (commits 103fad54, 8ec24ed0). The upstream fix was released in 1.5.7, and version 1.5.8 is a later release of the same line. Advisories: NVD (fixed in 1.5.7), CVE record (last affected 1.5.6).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-22752"
      },
      "impact_statement": "Prechecker: The upstream fix is already in this version's source history (commits 103fad54, 8ec24ed0). The upstream fix was released in 1.5.7, and version 1.5.8 is a later release of the same line. Advisories: NVD (fixed in 1.5.7), CVE record (last affected 1.5.6)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-23T11:01:49.503620+00:00",
      "status_notes": "Vulnerability CVE-2026-41008 does not affect version 1.5.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server. Spring Authorization Server 1.5.8 is not vulnerable as it is higher than upstream fix version - 1.5.7.1",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-41008"
      },
      "impact_statement": "Spring Authorization Server 1.5.8 is not vulnerable as it is higher than upstream fix version - 1.5.7.1"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:40:55.741562+00:00",
      "status_notes": "Vulnerability CVE-2026-47877 affects version 1.5.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server.",
      "vulnerability": {
        "name": "CVE-2026-47877"
      },
      "action_statement": "Vulnerability CVE-2026-47877 affects version 1.5.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-59316 affects version 1.5.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server.",
      "vulnerability": {
        "name": "CVE-2026-59316"
      },
      "action_statement": "Vulnerability CVE-2026-59316 affects version 1.5.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T18:34:10.986929+00:00",
      "status_notes": "Vulnerability CVE-2026-59354 affects version 1.5.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server.",
      "vulnerability": {
        "name": "CVE-2026-59354"
      },
      "action_statement": "Vulnerability CVE-2026-59354 affects version 1.5.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1",
          "identifiers": {
            "purl": "pkg:maven/org.springframework.security/spring-security-oauth2-authorization-server@1.5.8-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-29T07:42:31.773838+00:00",
      "status_notes": "Vulnerability CVE-2026-59355 does not affect version 1.5.8-tuxcare.1 of org.springframework.security:spring-security-oauth2-authorization-server. not_affected \u2014 The target Spring Authorization Server version 1.5.8-tuxcare.3 is NOT AFFECTED by CVE-2026-59355. The vulnerability was fixed in upstream commit 381b1493 (\"Polish redirect flows\") authored by Joe Grandja, which was already present in the Spring Authorization Server 1.5.8 release when TuxCare onboarded it. All three components of the fix are present in HEAD: (1) parameter extraction is prevented...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-59355"
      },
      "impact_statement": "not_affected \u2014 The target Spring Authorization Server version 1.5.8-tuxcare.3 is NOT AFFECTED by CVE-2026-59355. The vulnerability was fixed in upstream commit 381b1493 (\"Polish redirect flows\") authored by Joe Grandja, which was already present in the Spring Authorization Server 1.5.8 release when TuxCare onboarded it. All three components of the fix are present in HEAD: (1) parameter extraction is prevented..."
    }
  ]
}