Skip to content
CVE PROGRAM SOURCE RECORD8.2 High

CVE-2026-59316

Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
vmware

Description

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Spring Authorization Server 1.5.0 - 1.5.8 Spring Authorization Server 1.4.0 - 1.4.11

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Spring Spring Authorization Server

Default version status: unaffected

  • 1.5.0 to ≤ 1.5.8affected
  • 1.4.0 to ≤ 1.4.11affected

References