Cross-Site Scripting in Spring Authorization Server by VMware
CVE-2026-59316

8.2HIGH

Key Information:

Vendor

Spring

Status
Spring Authorization Server
Vendor
CVE Published:
27 August 2026

What is CVE-2026-59316?

The Spring Authorization Server's default consent page fails to properly encode user-controlled values, making it susceptible to Cross-Site Scripting (XSS) attacks. An attacker can exploit this vulnerability by crafting an OAuth2 authorization request with malicious parameters. These malicious values are stored server-side and later rendered on the consent page, which can trick users into executing harmful scripts. This exposes users to potential data theft and various attacks, compromising the security of the authorization flow.

Affected Version(s)

Spring Authorization Server 1.5.0 <= 1.5.8

Spring Authorization Server 1.4.0 <= 1.4.11

References

https://spring.io/security/cve-2026-59316

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.