CVE-2026-59316

Received Received - Intake

Cross-Site Scripting in Spring Authorization Server

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Spring Authorization Server 1.5.0 - 1.5.8 Spring Authorization Server 1.4.0 - 1.4.11

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-27

Generated

2026-08-28

AI Q&A

2026-08-28

EPSS Evaluated

N/A

NVD

CVE-2026-59316

Affected Vendors & Products

Vendor	Product	Version / Range
spring	authorization_server	From 1.5.0 (inc) to 1.5.8 (inc)
spring	authorization_server	From 1.4.0 (inc) to 1.4.11 (inc)
spring_project	spring_authorization_server	From 1.4.0 (inc) to 1.5.8 (inc)
spring_project	spring_authorization_server	From 1.4.0 (inc) to 1.4.11 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in Spring Authorization Server's default consent page. User-controlled values are rendered without HTML encoding, allowing attackers to inject malicious scripts via crafted OAuth2 requests. These scripts are stored server-side and displayed unencoded on the consent page.

Detection Guidance

Check if your Spring Authorization Server version is between 1.4.0-1.4.11 or 1.5.0-1.5.8. Inspect the consent page for unencoded user-controlled values in OAuth2 authorization requests. No specific commands are provided in the context.

Impact Analysis

An attacker could steal user sessions, perform actions on behalf of users, or deface the consent page. Users interacting with the vulnerable page may have their data compromised or be tricked into disclosing sensitive information.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance violations, fines, or reputational damage if exploited.

Mitigation Strategies

Upgrade to fixed versions 1.5.9 or 1.4.12 if using affected versions. If custom consent pages are used, no action is needed. Contact VMware Enterprise Support for updates as fixed versions are not publicly available.

Hi! I’m here to help you understand CVE-2026-59316. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70