PT-2026-123643

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.4.8-tuxcare.1...

PT-2026-123228

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.3.6-tuxcare.1...

Exploit for CVE-2016-4977

Spring Security OAuth2 Whitelabel SpEL RCE CVE-2016-4977 V...

ROOT-APP-MAVEN-AIKIDO-2026-61483 AIKIDO-2026-61483 in org.springframework.security:spring-security-oauth2-jose - Patched by Root

Root has patched AIKIDO-2026-61483 in the org.springframework.security:spring-security-oauth2-jose package for Root:Maven. Multiple fixed versions available...

CLSA-2026-1788874294 TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.5.8-tuxcare.1...

Cross-Site Scripting (XSS)

org.springframework.security, spring-security-oauth2-authorization-server is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the default consent page rendering user-controlled values without proper HTML entity encoding, which allows an attacker to inject malicious HTML or...

CVE-2026-59354

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.10.0, <=3.49.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.10.0, <=3.49.0) +47 more potentially affected by CVE-2026-59355 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.5.0, <=1.5.7)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.5.0, =3.10.0, =3.10.0, =1.0.0, =1.0.1, =1.0.0, =3.0.0, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.5.3, =3.5.5.3, =3.5.5.3, =3.5.0.0, =3.5.0.0, =3.5.5.2 and more Source cves: CVE-2026-59355 Source advisory:...

CVE-2026-59354 Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

EUVD-2026-66977

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

cn.herodotus.dante:dante-authentication-autoconfigure (>=4.0.0.0-m2, <=4.0.0.0-m3), cn.herodotus.dante:dante-logic-identity (>=4.0.0.0-m2, <=4.0.0.0-m3) +25 more potentially affected by CVE-2026-59354 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =0.1.0, =4.0.2.0-m4, =4.0.0.0-m4, =4.0.0.0-m4, =4.0.2.0-m4, =4.0.5.1 and more Source cves: CVE...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=5.4.0, <=10.0.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=5.4.0, <=10.0.0) +80 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (7.1.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=4.0.0-alpha-springboot4, <=5.3.1), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=4.0.0-alpha-springboot4, <=5.3.1) +74 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (>=7.0.0, <=7.0.6)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =7.0.0, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =3.6.0, =3.5.0, =5.0.0, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =4.0.0.0-m2, =v2.0.0, =2.0.1 -...

be.appify.prefab:prefab-security (>=0.11.0, <=0.12.0), build.jenesis:build.jenesis.repository.bundle (>=0.1.0, <=0.7.0) +428 more potentially affected by CVE-2026-41707 via org.springframework.security:spring-security-oauth2-jose (7.1.0)

org.springframework.security:spring-security-oauth2-jose MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-jose and may be impacted: - be.appify.prefab:prefab-security =0.11.0, =0.1....

be.appify.prefab:prefab-security (>=0.2.0, <=0.10.9), br.com.sawcunhaos:scos-foundation-security (1.1.0) +606 more potentially affected by CVE-2026-41707 via org.springframework.security:spring-security-oauth2-jose (>=7.0.0, <=7.0.6)

org.springframework.security:spring-security-oauth2-jose MAVEN version =7.0.0, =0.2.0, =5.0.0, =5.0.0, =5.0.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =4.0.0-alpha-springboot4,...

Replay Attack

Overview org.springframework.security:spring-security-oauth2-jose is a provides security services for the Spring IO Platform. Affected versions of this package are vulnerable to Replay Attack through the DPoPProofJwtDecoderFactory. An attacker can gain unauthorized access and impersonate a victim...

ch.admin.bit.jeap:jeap-oauth-mock-server (>=3.1.0, <=3.9.3), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=3.1.0, <=3.9.3) +30 more potentially affected by CVE-2026-59316 via org.springframework.security:spring-security-oauth2-authorization-server (>=1.4.0, <=1.4.8)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version =1.4.0, =3.1.0, =3.1.0, =3.4.0.0, =3.4.0.0, =3.4.0.0, =3.4.0.0, =0.0.23, =0.0.2, =0.0.11, =1.0.0, =3.4.0, =1.2.7, =1.2.6, =2.12.0, =3.1.0 and more Source cves: CVE-2026-59316 Source advisory:...

ai.mindconnect:mc-agent-admin-ui-app (>=0.0.2, <=0.8.4), ai.mindconnect:mc-agent-admin-ui-rest (>=0.0.2, <=0.8.4) +1192 more potentially affected by CVE-2026-41707 via org.springframework.security:spring-security-oauth2-jose (>=6.5.0, <=7.0.6)

org.springframework.security:spring-security-oauth2-jose MAVEN version =6.5.0, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =1.0.0.ee-20260424025040, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =1.24.0, =1.24.0, =6.3.0 and more Source cves: CVE-2026-41707 Source advisory:...

be.appify.prefab:prefab-security (>=0.11.0, <=0.12.0), build.jenesis:build.jenesis.repository.bundle (>=0.1.0, <=0.7.0) +428 more potentially affected by CVE-2026-41707 via org.springframework.security:spring-security-oauth2-jose (7.1.0)

org.springframework.security:spring-security-oauth2-jose MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-jose and may be impacted: - be.appify.prefab:prefab-security =0.11.0, =0.1....

ch.admin.bit.jeap:jeap-oauth-mock-server (>=5.4.0, <=10.0.0), ch.admin.bit.jeap:jeap-oauth-mock-server-instance (>=5.4.0, <=10.0.0) +80 more potentially affected by CVE-2026-47877 via org.springframework.security:spring-security-oauth2-authorization-server (7.1.0)

org.springframework.security:spring-security-oauth2-authorization-server MAVEN version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-oauth2-authorization-server and may be impacted: -...