CLSA-2026-1788874294 TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.5.8-tuxcare.1...

Cross-Site Scripting (XSS)

org.springframework.security, spring-security-oauth2-authorization-server is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the default consent page rendering user-controlled values without proper HTML entity encoding, which allows an attacker to inject malicious HTML or...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.10.0, <=3.49.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.10.0, <=3.49.0) +47 more potentially affected by CVE-2026-59355 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.5.0, <=1.5.7)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.5.0, =3.10.0, =3.10.0, =1.0.0, =1.0.1, =1.0.0, =3.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-59355 Source advisory:...

cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3), cn.herodotus.dante:dante-logic-identity (>=4.0.0.0-m2, <=4.0.0.0-m3) +25 more potentially affected by CVE-2026-59354 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =0.1.0, =4.0.2.0-m4, =4.0.0.0-m4, =4.0.0.0-m4, =4.0.2.0-m4, =4.0.5.1 and more Source cves: CVE...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=5.4.0, <=10.0.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=5.4.0, <=10.0.0) +80 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (7.1.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=4.0.0-alpha-springboot4, <=5.3.1), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=4.0.0-alpha-springboot4, <=5.3.1) +74 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.6)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =3.6.0, =3.5.0, =5.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =2.0.1 -...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=4.0.0-alpha-springboot4, <=5.3.1), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=4.0.0-alpha-springboot4, <=5.3.1) +74 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.6)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =3.6.0, =3.5.0, =5.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =2.0.1 -...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=5.4.0, <=10.0.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=5.4.0, <=10.0.0) +80 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (7.1.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.1.0, <=3.9.3), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.1.0, <=3.9.3) +30 more potentially affected by CVE-2026-59316 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.4.0, <=1.4.8)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.4.0, =3.1.0, =3.1.0, =3.4.0.0, =3.4.0.0, =3.4.0.0, =3.4.0.0, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =3.4.0, =1.2.7, =1.2.6, =2.12.0, =3.1.0 and more Source cves: CVE-2026-59316 Source advisory:...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.10.0, <=3.50.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.10.0, <=3.50.0) +49 more potentially affected by CVE-2026-59316 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.5.0, <=1.5.8)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.5.0, =3.10.0, =3.10.0, =1.0.0, =1.0.1, =1.0.0, =3.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-59316 Source advisory:...

PT-2026-73704

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.1.4-tuxcare.1...

cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3), cn.herodotus.dante:dante-logic-identity (>=4.0.0.0-m2, <=4.0.0.0-m3) +25 more potentially affected by CVE-2026-22752 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =0.1.0, =4.0.2.0-m4, =4.0.0.0-m4, =4.0.0.0-m4, =4.0.2.0-m4, =4.0.5.1 and more Source cves: CVE...

cn.herodotus.engine:oauth2-authorization-server-autoconfigure (>=3.3.0.0, <=3.3.6.1), cn.herodotus.engine:oauth2-sdk-authentication (>=3.3.0.0, <=3.3.6.1) +41 more potentially affected by CVE-2026-22752 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.3.0, <=1.3.7)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.3.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =1.1.3, =2.4.0, =2.5.0, =2.3.1, =2.3.1, =2.3.6 and more Source cves: CVE-2026-22752 Source advisory:...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.1.0, <=3.9.3), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.1.0, <=3.9.3) +30 more potentially affected by CVE-2026-22752 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.4.0, <=1.4.8)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.4.0, =3.1.0, =3.1.0, =3.4.0.0, =3.4.0.0, =3.4.0.0, =3.4.0.0, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =3.4.0, =1.2.7, =1.2.6, =2.12.0, =3.1.0 and more Source cves: CVE-2026-22752 Source advisory: MEND:CVE-2026-2275...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.10.0, <=3.44.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.10.0, <=3.44.0) +47 more potentially affected by CVE-2026-22752 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.5.0, <=1.5.6)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.5.0, =3.10.0, =3.10.0, =1.0.0, =1.0.1, =1.0.0, =3.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-22752 Source advisory:...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.10.0, <=3.49.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.10.0, <=3.49.0) +47 more potentially affected by CVE-2026-41008 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.5.0, <=1.5.7)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.5.0, =3.10.0, =3.10.0, =1.0.0, =1.0.1, =1.0.0, =3.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-41008 Source advisory:...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=4.0.0-alpha-springboot4, <=5.2.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=4.0.0-alpha-springboot4, <=5.2.0) +66 more potentially affected by CVE-2026-41008 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =3.6.0, =3.5.0, =5.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =2.0.1 -...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.10.0, <=3.49.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.10.0, <=3.49.0) +47 more potentially affected by CVE-2026-41008 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.5.0, <=1.5.7)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.5.0, =3.10.0, =3.10.0, =1.0.0, =1.0.1, =1.0.0, =3.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-41008 Source advisory:...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=4.0.0-alpha-springboot4, <=5.2.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=4.0.0-alpha-springboot4, <=5.2.0) +66 more potentially affected by CVE-2026-41008 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.5)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =3.6.0, =3.5.0, =5.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =2.0.1 -...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.10.0, <=3.49.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.10.0, <=3.49.0) +47 more potentially affected by CVE-2026-41008 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.5.0, <=1.5.7)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.5.0, =3.10.0, =3.10.0, =1.0.0, =1.0.1, =1.0.0, =3.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-41008 Source advisory:...