diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-5.8.rnc b/config/src/main/resources/org/springframework/security/config/spring-security-5.8.rnc
index 24d08c9e16..86ded9594e 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-5.8.rnc
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-5.8.rnc
@@ -291,7 +291,7 @@ websocket-message-broker.attrlist &=
 websocket-message-broker.attrlist &=
 	## Disables the requirement for CSRF token to be present in the Stomp headers (default false). Changing the default is useful if it is necessary to allow other origins to make SockJS connections.
 	attribute same-origin-disabled {xsd:boolean}?
-websocket-message-broker.attlist &=
+websocket-message-broker.attrlist &=
 	## Use this AuthorizationManager instead of deriving one from <intercept-message> elements
 	attribute authorization-manager-ref {xsd:string}?
 websocket-message-broker.attrlist &=
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-5.8.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-5.8.xsd
index c9e2322fa8..f7f9977f47 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-5.8.xsd
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-5.8.xsd
@@ -915,20 +915,18 @@
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
-      <xs:attribute name="use-authorization-manager" type="xs:boolean">
-         <xs:annotation>
-            <xs:documentation>Use AuthorizationManager API instead of SecurityMetadatasource
-                </xs:documentation>
-         </xs:annotation>
-      </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="websocket-message-broker.attlist">
       <xs:attribute name="authorization-manager-ref" type="xs:string">
          <xs:annotation>
             <xs:documentation>Use this AuthorizationManager instead of deriving one from &lt;intercept-message&gt; elements
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
+      <xs:attribute name="use-authorization-manager" type="xs:boolean">
+         <xs:annotation>
+            <xs:documentation>Use AuthorizationManager API instead of SecurityMetadatasource
+                </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
   </xs:attributeGroup>
   <xs:element name="intercept-message">
       <xs:annotation>
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc
index bde71706d4..26d9f3bfa8 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc
@@ -291,7 +291,7 @@ websocket-message-broker.attrlist &=
 websocket-message-broker.attrlist &=
 	## Disables the requirement for CSRF token to be present in the Stomp headers (default false). Changing the default is useful if it is necessary to allow other origins to make SockJS connections.
 	attribute same-origin-disabled {xsd:boolean}?
-websocket-message-broker.attlist &=
+websocket-message-broker.attrlist &=
 	## Use this AuthorizationManager instead of deriving one from <intercept-message> elements
 	attribute authorization-manager-ref {xsd:string}?
 websocket-message-broker.attrlist &=
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd
index 6ea105a688..510e04af2b 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd
@@ -915,20 +915,18 @@
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
-      <xs:attribute name="use-authorization-manager" type="xs:boolean">
-         <xs:annotation>
-            <xs:documentation>Use AuthorizationManager API instead of SecurityMetadatasource
-                </xs:documentation>
-         </xs:annotation>
-      </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="websocket-message-broker.attlist">
       <xs:attribute name="authorization-manager-ref" type="xs:string">
          <xs:annotation>
             <xs:documentation>Use this AuthorizationManager instead of deriving one from &lt;intercept-message&gt; elements
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
+      <xs:attribute name="use-authorization-manager" type="xs:boolean">
+         <xs:annotation>
+            <xs:documentation>Use AuthorizationManager API instead of SecurityMetadatasource
+                </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
   </xs:attributeGroup>
   <xs:element name="intercept-message">
       <xs:annotation>