PT-2026-123643

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.4.8-tuxcare.1...

PT-2026-123228

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.3.6-tuxcare.1...

Exploit for CVE-2016-4977

Spring Security OAuth2 Whitelabel SpEL RCE CVE-2016-4977 V...

ROOT-APP-MAVEN-AIKIDO-2026-61483 AIKIDO-2026-61483 in org.springframework.security:spring-security-oauth2-jose - Patched by Root

Root has patched AIKIDO-2026-61483 in the org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available...

CLSA-2026-1788874294 TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.5.8-tuxcare.1...

Cross-Site Scripting (XSS)

org.springframework.security, spring-security-oauth2-authorization-server is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the default consent page rendering user-controlled values without proper HTML entity encoding, which allows an attacker to inject malicious HTML or...

CVE-2026-59354

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.10.0, <=3.49.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.10.0, <=3.49.0) +47 more potentially affected by CVE-2026-59355 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.5.0, <=1.5.7)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.5.0, =3.10.0, =3.10.0, =1.0.0, =1.0.1, =1.0.0, =3.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-59355 Source advisory:...

CVE-2026-59354 Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3), cn.herodotus.dante:dante-logic-identity (>=4.0.0.0-m2, <=4.0.0.0-m3) +25 more potentially affected by CVE-2026-59354 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =0.1.0, =4.0.2.0-m4, =4.0.0.0-m4, =4.0.0.0-m4, =4.0.2.0-m4, =4.0.5.1 and more Source cves: CVE...

EUVD-2026-66977

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=4.0.0-alpha-springboot4, <=5.3.1), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=4.0.0-alpha-springboot4, <=5.3.1) +74 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.6)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =3.6.0, =3.5.0, =5.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =2.0.1 -...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=5.4.0, <=10.0.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=5.4.0, <=10.0.0) +80 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (7.1.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

be.appify.prefab:prefab-security (>=0.11.0, <=0.12.0), build.jenesis:build.jenesis.repository.bundle (>=0.1.0, <=0.7.0) +428 more potentially affected by CVE-2026-41707 via org.springframework.security:spring-security-oauth2-jose (7.1.0)

org.springframework.security:spring-security-oauth2-jose MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-jose and may be impacted: - be.appify.prefab:prefab-security =0.11.0, =0.1....

be.appify.prefab:prefab-security (>=0.2.0, <=0.10.9), br.com.sawcunhaos:scos-foundation-security (1.1.0) +606 more potentially affected by CVE-2026-41707 via org.springframework.security:spring-security-oauth2-jose (>=7.0.0, <=7.0.6)

org.springframework.security:spring-security-oauth2-jose MAVEN version =7.0.0, =0.2.0, =5.0.0, =5.0.0, =5.0.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =4.0.0-alpha-springboot4,...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.1.0, <=3.9.3), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.1.0, <=3.9.3) +30 more potentially affected by CVE-2026-59316 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.4.0, <=1.4.8)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.4.0, =3.1.0, =3.1.0, =3.4.0.0, =3.4.0.0, =3.4.0.0, =3.4.0.0, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =3.4.0, =1.2.7, =1.2.6, =2.12.0, =3.1.0 and more Source cves: CVE-2026-59316 Source advisory:...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.10.0, <=3.50.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.10.0, <=3.50.0) +49 more potentially affected by CVE-2026-59316 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.5.0, <=1.5.8)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.5.0, =3.10.0, =3.10.0, =1.0.0, =1.0.1, =1.0.0, =3.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-59316 Source advisory:...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=4.0.0-alpha-springboot4, <=5.3.1), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=4.0.0-alpha-springboot4, <=5.3.1) +74 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.6)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =3.6.0, =3.5.0, =5.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =2.0.1 -...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=5.4.0, <=10.0.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=5.4.0, <=10.0.0) +80 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (7.1.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

be.appify.prefab:prefab-security (>=0.11.0, <=0.12.0), build.jenesis:build.jenesis.repository.bundle (>=0.1.0, <=0.7.0) +428 more potentially affected by CVE-2026-41707 via org.springframework.security:spring-security-oauth2-jose (7.1.0)

org.springframework.security:spring-security-oauth2-jose MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-jose and may be impacted: - be.appify.prefab:prefab-security =0.11.0, =0.1....