Open Redirect

Spring Authorization Server is vulnerable to open redirect. The vulnerability is due to insufficient validation of the requesturi parameter, where the authorization endpoint allows an attacker to craft a request containing an invalid requesturi paired with an unvalidated redirecturi, resulting in...

CLSA-2026-1788874294 TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.5.8-tuxcare.1...

Cross-Site Scripting (XSS)

org.springframework.security, spring-security-oauth2-authorization-server is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the default consent page rendering user-controlled values without proper HTML entity encoding, which allows an attacker to inject malicious HTML or...

CLSA-2026-1788528946 TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.3.7-tuxcare.6...

CVE-2026-55221

Boruta is a standalone authorization server implementing OAuth 2.0 and OpenID Connect up to decentralized identity specifications. Prior to version 0.10.0 , Boruta logged sensitive credentials—including access tokens , refresh tokens , authorization codes , agent tokens , direct-post codes , ID t...

CVE-2026-55221 Boruta: OAuth credentials exposed in Boruta business logs

Boruta is a standalone authorization server that aims to implement OAuth 2.0 and Openid Connect up to decentralized identity specifications. Prior to version 0.10.0, Boruta logged sensitive OAuth and OpenID Connect values in business event logs. Logged values could include access tokens, refresh...

CVE-2026-59316

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

CVE-2026-59316 Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

EUVD-2026-67198

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

CVE-2026-59316 Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

CVE-2026-59316

CVE-2026-59316 is a stored XSS vulnerability in Spring Authorization Server 's DefaultConsentPage . User-controlled values from an OAuth2 authorization request are rendered without HTML entity encoding, allowing an attacker to inject malicious scripts that execute when the consent page is present...

CVE-2026-59355

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to...

CVE-2026-59354

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

CVE-2026-59355 Spring Authorization Server: Open Redirect via request_uri parameter

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to...

CVE-2026-59355

Spring Authorization Server versions 1.5.0 through 1.5.7 are affected by an open redirect vulnerability in the authorization endpoint . The root cause is insufficient validation of the request_uri parameter : an attacker can craft a request containing an invalid request_uri paired with an unvalid...

CVE-2026-59355 Spring Authorization Server: Open Redirect via request_uri parameter

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to...

EUVD-2026-66978

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to...

CVE-2026-59354 Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

CVE-2026-59354

Spring Security's OAuth2 Authorization Server module (versions 7.0.0 through 7.0.4 ) is affected by insufficient validation of client metadata fields at the Dynamic Client Registration endpoint. When Dynamic Client Registration is explicitly enabled, an attacker holding a valid Initial Access Tok...

CVE-2026-47877

Spring Security Authorization Server is vulnerable to Cross-Site Scripting (XSS) in its default consent page, which renders user-controlled values without HTML entity encoding. The flaw allows an attacker to inject scripts via crafted input reflected on the consent page, requiring user interactio...