Spring Authorization Server vulnerabilities

An authentication bypass vulnerability due to a primary weakness in Spring Authorization Server. Affects versions from 7.0.0 to 7.0.4, from 1.5.0 to 1.5.6, from 1.4.0 to 1.4.9, and from 1.3.0 to 1.3.10.

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. An attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page. Affected versions are 1.5.0-1.5.8 and 1.4.0-1.4.11.

In Spring Authorization Server versions 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request with an invalid request_uri and an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.