CVE-2026-59316
HighCVSS 8.2Summary
Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. An attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page. Affected versions are 1.5.0-1.5.8 and 1.4.0-1.4.11.
Risk Assessment
The risk includes XSS attacks on the consent page, potentially leading to session theft or unauthorized actions on behalf of the user.
Recommendation
It is recommended to upgrade Spring Authorization Server to a patched version or implement additional HTML entity encoding for values rendered on the consent page.
Original NVD description (English source)
Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Spring Authorization Server 1.5.0 - 1.5.8 Spring Authorization Server 1.4.0 - 1.4.11