Issues

• Default passkey pages fail with NullPointerException when CSRF is disabled

  status: waiting-for-triage
  spring-projects/spring-security#19984 · Filter by author codeconsole opened on Oct 23, 2026

• Spring-security-7.1.xsd schema validates request-matcher incorrectly

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19981 · Filter by author MichaelVetter opened on Oct 23, 2026
  1

• CoreJackson2Module has no mixin for OneTimeTokenAuthentication

  status: waiting-for-triage
  spring-projects/spring-security#19963 · Filter by author sharanggupta opened on Oct 22, 2026

• Consider using JDBC batch updates for authority insertion in JdbcUserDetailsManager

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19962 · Filter by author ziyouzy opened on Oct 22, 2026

• KerberosRestTemplate throws RestClientException when doExecute() returns null

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19935 · Filter by author un1024 opened on Oct 20, 2026
  1

• Allow disabling per-filter events in SecurityObservationSettings

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19922 · Filter by author ThomasVitale opened on Oct 16, 2026
  1

• Allow configuring the DPoP Proof verifier for the Authorization Server

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19881 · Filter by author timpeeters opened on Oct 14, 2026

• DPoP-bound access tokens rejected at Authorization Server protected endpoints

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19876 · Filter by author timpeeters opened on Oct 13, 2026

• BearerTokenAuthenticationEntryPoint emits resource_metadata="null" when the resource metadata parameter resolver returns null

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19874 · Filter by author kelseyh opened on Oct 12, 2026

• @EnableMultiFactorAuthentication.authorities should default to {}

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19868 · Filter by author Ali-Hassan33 opened on Oct 9, 2026
  1

• Missing class StringUtils since 7.1.0, causing NoClassDefFoundError

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19867 · Filter by author ewan-escience opened on Oct 9, 2026
  1

• One-time token login does not set authentication details, and authenticationDetailsSource has no effect

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19863 · Filter by author jsunsoftware opened on Oct 9, 2026

• add jdcdaoimpl username to lowercase support

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19849 · Filter by author joshlong opened on Oct 8, 2026
  1

• MapUserCredentialRepository leaves a stale owner index when a credential ID is reassigned

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19847 · Filter by author 789-yu opened on Oct 8, 2026

• OAuth2 Authorization Server accepts malformed PKCE code challenges

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19845 · Filter by author gtaylor-exactsciences opened on Oct 7, 2026
  3

• Use Content-Security-Policy nonce support on Default login and passkey registration pages

  in: webin: webauthntype: enhancement
  spring-projects/spring-security#19844 · Filter by author jzheaux opened on Oct 7, 2026

• Fix method chaining in ServerHttpSecurity.HeaderSpec.ContentSecurityPolicySpec

  in: configtype: enhancement
  spring-projects/spring-security#19843 · Filter by author jzheaux opened on Oct 7, 2026
  2

• Repeated calls to headers.contentSecurityPolicy(...) should not clobber previous ones

  in: configtype: enhancement
  spring-projects/spring-security#19842 · Filter by author jzheaux opened on Oct 7, 2026
  3

• HttpSecurityDsl should expose underlying HttpSecurity

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19834 · Filter by author ilia1243 opened on Oct 5, 2026

• SAML HTTP-POST binding moves destination query parameters into form fields

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19810 · Filter by author bolinda-ov opened on Sep 30, 2026
  2

• Inheritance of AbstractAuthenticationBuilder in Kotlin

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19805 · Filter by author ilia1243 opened on Sep 29, 2026

• some of the types that are serialized in the session should also be registered as serializable in graalvm aot hints

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19804 · Filter by author joshlong opened on Sep 29, 2026

• Avoid eager PasswordEncoder initialization in ClientSecretAuthenticationProvider

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19783 · Filter by author alexey-anufriev opened on Sep 24, 2026

• MethodSecurityExpressionHandler doesn't allow null to be returned when filtering

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19781 · Filter by author GFriedrich opened on Sep 23, 2026

• Concurrent Session Management does not fully invalidate OIDC sessions after Back-Channel Logout

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19780 · Filter by author Molly-Guan opened on Sep 23, 2026