CVE-2026-47877

Spring Security Authorization Server is vulnerable to Cross-Site Scripting (XSS) in its default consent page, which renders user-controlled values without HTML entity encoding. The flaw allows an attacker to inject scripts via crafted input reflected on the consent page, requiring user interactio...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=5.4.0, <=10.0.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=5.4.0, <=10.0.0) +80 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (7.1.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

CVE-2026-47877 Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

EUVD-2026-66840

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

CVE-2026-47877 Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

CVE-2026-47877 Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

CVE-2026-59277: Protection Mechanism Failure

Spring Security's InetAddressMatchers utility provides matchInternal and matchExternal builders for constructing an InetAddressMatcher that classifies a given IP address as belonging to an internal private or external public network. Spring Security 7.1.0...

CVE-2026-59276: Observable Timing Discrepancy

Several components in Spring Security compare security-sensitive values using standard string equality String.equals rather than a constant-time comparison. Because String.equals returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the...

CVE-2026-59354: Improper Input Validation

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

CVE-2026-59270: Incorrect Authorization

Spring Security's embedded UnboundID LDAP server UnboundIdContainer unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18...

PT-2026-82690

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Spring Security versions 6.4.0 through 6.4.18 Spring Security versions 5.8.0 through 5.8.27 Spring Security versions 5.7.0...

PT-2026-82413

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Spring Security versions 6.4.0 through 6.4.18 Spring Security versions 5.8.0 through 5.8.27 Spring Security versions 5.7.0...

PT-2026-82446

Name of the Vulnerable Software and Affected Versions Spring Security OAuth2 Authorization Server versions 7.0.0 through 7.0.4 Description When Dynamic Client Registration is enabled, the registration endpoint does not sufficiently validate certain client metadata fields provided by the registeri...

A Bootiful Podcast: Joe Grandja on Spring Authorization Server, OAuth, and so much more

Hi, Spring fans! In this episode, I talk Spring Security’s Joe Grandja about Spring Authorization Server’s graduation into Spring Security 7, and the new security heavyweights DPoP and PAR...

PT-2026-82691

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Description The InetAddressMatchers utility provides matchInternal and matchExternal builders used to create an InetAddressMatcher. This component is responsible for classifying whether a provided IP address belon...

PT-2026-82396

Name of the Vulnerable Software and Affected Versions Spring Security versions 7.0.0 through 7.0.6 Spring Security version 7.1.0 Description The default consent page of the Spring Security Authorization Server renders user-controlled values without applying HTML entity encoding. This lack of...

CVE-2026-47877: Improper Neutralization of Input During Web Page Generation

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6...

CVE-2026-47842

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null all-zero initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Sprin...

be.appify.prefab:prefab-security (>=0.2.0, <=0.10.9), br.com.sawcunhaos:scos-foundation-audit (>=1.0.0, <=1.1.0) +2518 more potentially affected by CVE-2026-47842 via org.springframework.security:spring-security-crypto (>=7.0.0, <=7.0.6)

org.springframework.security:spring-security-crypto MAVEN version =7.0.0, =0.2.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =5.0.0, =5.0.0, =5.0.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =8.0.0-alpha-springboot4, =8.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =4.0.0-alpha-springboot4,...

CVE-2026-47842

Spring Security 's AesBytesEncryptor deterministically encrypts data with AES/CBC when the two-argument constructor is used or a null IV generator is passed with CBC mode, resulting in a null (all-zero) initialization vector . This causes identical plaintexts to always produce identical ciphertex...