CVE-2026-59354
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In Spring Security's OAuth2 Authorization Server module versions 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields. An attacker with a valid Initial Access Token can register a malicious client with crafted metadata, which may result in Stored XSS, Privilege Escalation, or SSRF.
Risk Assessment
The vulnerability may allow an attacker to execute scripts in the application context, escalate privileges, or use the server for attacks on other systems, posing a serious security threat.
Recommendation
Update Spring Security OAuth2 Authorization Server to a patched version and consider disabling dynamic client registration if not essential.
Original NVD description (English source)
In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possesses a valid Initial Access Token can register a malicious client with crafted metadata, which, depending on server configuration and how the metadata is later rendered or used, may result in Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).