Insufficient Validation in Spring Security's OAuth2 Authorization Server

CVE-2026-59354

What is CVE-2026-59354?

The OAuth2 Authorization Server module in Spring Security versions 7.0.0 through 7.0.4 has a vulnerability due to insufficient validation of client metadata fields during the dynamic client registration process. An attacker with a valid Initial Access Token can exploit this flaw to register a malicious client with manipulated metadata. Depending on how this metadata is used or rendered within the server configuration, it can lead to security risks such as Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF). It highlights the need for robust validation mechanisms to prevent unauthorized access and protect server resources.

References