CVE-2026-59316
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. An attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page. Affected versions are 1.5.0-1.5.8 and 1.4.0-1.4.11.
Risk Assessment
The risk includes XSS attacks on the consent page, potentially leading to session theft or unauthorized actions on behalf of the user.
Recommendation
It is recommended to upgrade Spring Authorization Server to a patched version or implement additional HTML entity encoding for values rendered on the consent page.
Other vulnerabilities in Spring Authorization Server
See all- CVE-2026-22752Critical
An authentication bypass vulnerability due to a primary weakness in Spring Authorization Server. Affects versions from 7.0.0 to 7.0.4, from 1.5.0 to 1.5.6, from 1.4.0 to 1.4.9, and from 1.3.0 to 1.3.10.
- CVE-2026-59355Medium
In Spring Authorization Server versions 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request with an invalid request_uri and an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.
Original NVD description (English source)
Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Spring Authorization Server 1.5.0 - 1.5.8 Spring Authorization Server 1.4.0 - 1.4.11
Vulnerability data from NVD (NIST) · CISA KEV · EPSS