CVE-2026-59316

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

CVE-2026-59316: Improper Neutralization of Input During Web Page Generation

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

PT-2026-82720

Name of the Vulnerable Software and Affected Versions Spring Authorization Server versions 1.4.0 through 1.4.11 Spring Authorization Server versions 1.5.0 through 1.5.8 Description The default consent page renders user-controlled values without HTML entity encoding. When using the...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the DefaultConsentPage process. An attacker can execute arbitrary JavaScript code in the context of the user's browser by crafting an OAuth2 authorization request containing a malicious value that is stored...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the DefaultConsentPage process. An attacker can execute arbitrary scripts in the context of the user's browser by crafting an OAuth2 authorization request containing a malicious value that is stored server-si...