Spring Spring Authorization Server vulnerabilities (CVE)

CVE records published for Spring Spring Authorization Server, newest first. Follow to get an email when a new one appears.

2 results

8.2High

CVE-2026-59316 2 months ago

Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Spring Authorization Server

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side an…

6.1Medium

CVE-2026-41008 5 months ago

Spring Security Authorization Server Open Redirect via request_uri

Spring Spring Security; Spring Spring Authorization Server

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, …