Issues

• @EnableMultiFactorAuthentication.authorities should default to {}

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19868 · Filter by author Ali-Hassan33 opened on Oct 9, 2026

• Missing class StringUtils since 7.1.0, causing NoClassDefFoundError

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19867 · Filter by author ewan-escience opened on Oct 9, 2026

• One-time token login does not set authentication details, and authenticationDetailsSource has no effect

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19863 · Filter by author jsunsoftware opened on Oct 9, 2026

• add jdcdaoimpl username to lowercase support

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19849 · Filter by author joshlong opened on Oct 8, 2026

• MapUserCredentialRepository leaves a stale owner index when a credential ID is reassigned

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19847 · Filter by author 789-yu opened on Oct 8, 2026

• OAuth2 Authorization Server accepts malformed PKCE code challenges

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19845 · Filter by author gtaylor-exactsciences opened on Oct 7, 2026

• Use Content-Security-Policy nonce support on Default login and passkey registration pages

  in: webin: webauthntype: enhancement
  spring-projects/spring-security#19844 · Filter by author jzheaux opened on Oct 7, 2026

• Fix method chaining in ServerHttpSecurity.HeaderSpec.ContentSecurityPolicySpec

  in: configtype: enhancement
  spring-projects/spring-security#19843 · Filter by author jzheaux opened on Oct 7, 2026
  2

• Repeated calls to headers.contentSecurityPolicy(...) should not clobber previous ones

  in: configtype: enhancement
  spring-projects/spring-security#19842 · Filter by author jzheaux opened on Oct 7, 2026
  1

• HttpSecurityDsl should expose underlying HttpSecurity

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19834 · Filter by author ilia1243 opened on Oct 5, 2026

• SAML HTTP-POST binding moves destination query parameters into form fields

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19810 · Filter by author bolinda-ov opened on Sep 30, 2026
  2

• Inheritance of AbstractAuthenticationBuilder in Kotlin

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19805 · Filter by author ilia1243 opened on Sep 29, 2026

• some of the types that are serialized in the session should also be registered as serializable in graalvm aot hints

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19804 · Filter by author joshlong opened on Sep 29, 2026

• Avoid eager PasswordEncoder initialization in ClientSecretAuthenticationProvider

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19783 · Filter by author alexey-anufriev opened on Sep 24, 2026

• MethodSecurityExpressionHandler doesn't allow null to be returned when filtering

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19781 · Filter by author GFriedrich opened on Sep 23, 2026

• Concurrent Session Management does not fully invalidate OIDC sessions after Back-Channel Logout

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19780 · Filter by author Molly-Guan opened on Sep 23, 2026

• support easy per-platform sql initialization

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19776 · Filter by author joshlong opened on Sep 21, 2026
  3

• Client authentication errors cannot be serialised differently without reimplementing onAuthenticationFailure

  status: waiting-for-triage
  spring-projects/spring-security#19742 · Filter by author nolem opened on Sep 16, 2026
  1

• Token endpoint: a converter that declines gets the same answer as an unknown grant type

  status: waiting-for-triage
  spring-projects/spring-security#19741 · Filter by author nolem opened on Sep 16, 2026

• IpInetAddressMatcher throws ArrayIndexOutOfBoundsException instead of returning false for mismatched IPv4/IPv6 families

  status: waiting-for-triage
  spring-projects/spring-security#19733 · Filter by author minwoo-3 opened on Sep 16, 2026

• [doc issue] filter ordering

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19730 · Filter by author yousef-fadli opened on Sep 15, 2026

• (doc issue) permitAll/denyAll listed as "methods" in docs but are actually fields in SecurityExpressionRoot

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19728 · Filter by author yousef-fadli opened on Sep 15, 2026
  2

• XML configuration tests fail with a non-English locale

  status: waiting-for-triagetype: bug
  spring-projects/spring-security#19725 · Filter by author noojung opened on Sep 15, 2026

• Make the digest algorithm configurable for SAML authentication request and SAML Logout request

  status: waiting-for-triagetype: enhancement
  spring-projects/spring-security#19718 · Filter by author judicial1855-a11y opened on Sep 14, 2026

• Dependabot auto-merge should not apply to minor release updates

  in: buildtype: task
  spring-projects/spring-security#19717 · Filter by author jzheaux opened on Sep 14, 2026