Is CVE-2022-22969 actively exploited?

No active exploitation of CVE-2022-22969 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2022-22969 be exploited remotely?

Yes. CVE-2022-22969 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2022-22969?

CVE-2022-22969 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2022-22969

MEDIUM

CVE-2022-22969

NVD-CWE-noinfoPublished: April 21, 2022· Updated: Jun 17, 2026

6.5

CVSS v3.1

Official Description

<Issue Description> Spring Security OAuth versions 2.5.x prior to 2.5.2 and older unsupported versions are susceptible to a Denial-of-Service (DoS) attack via the initiation of the Authorization Request in an OAuth 2.0 Client application. A malicious user or attacker can send multiple requests initiating the Authorization Request for the Authorization Code Grant, which has the potential of exhausting system resources using a single session. This vulnerability exposes OAuth 2.0 Client applications only.

NVD Source

Technical Analysis

CVE-2022-22969 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in availability disruption (denial of service), with a CVSS base score of 6.5.