CVE-2026-47877

Analyzed Analyzed - Analysis Complete

Spring Security Authorization Server Default Consent Page XSS

Publication date: 2026-08-27

Last updated on: 2026-09-02

Assigner: VMware

Description

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-09-02

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-47877

EUVD

EUVD-2026-66840

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_security	From 7.1.0 (inc) to 7.1.0.1 (exc)
vmware	spring_security	From 7.0.0 (inc) to 7.0.6.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) flaw in Spring Security Authorization Server's default consent page. It occurs because user-controlled values are rendered without proper HTML entity encoding, allowing attackers to inject malicious scripts through crafted OAuth2 authorization requests.

Detection Guidance

To detect this vulnerability, inspect your Spring Security Authorization Server for the default consent page (DefaultConsentPage). Check if user-controlled values in OAuth2 authorization requests are rendered without HTML entity encoding. Review server logs for unusual script injections or XSS attempts in consent page responses.

Impact Analysis

Attackers could exploit this to execute arbitrary scripts in a victim's browser when they view the consent page. This may lead to session hijacking, data theft, or phishing attacks. Only systems using the default consent page are affected.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles and HIPAA's security requirements for protected health information.

Mitigation Strategies

Immediately upgrade to fixed versions: 7.1.1 (OSS), 7.1.0.1 (Enterprise), 7.0.7 (OSS), or 7.0.6.1 (Enterprise). If custom consent pages are used, no further action is needed. Otherwise, apply the patch as soon as possible to prevent XSS exploitation.

Hi! I’m here to help you understand CVE-2026-47877. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70