CVE-2026-59316: Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Spring Authorization Server 1.5.0 - 1.5.8 Spring Authorization Server 1.4.0 - 1.4.11
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using Spring Authorization Server's DefaultConsentPage are affected in versions 1.5.0 through 1.5.8 and 1.4.0 through 1.4.11. The issue is specifically in the default consent-page rendering path.
What does an attacker need to exploit this issue?
An attacker can send a crafted OAuth2 authorization request containing a malicious value. Exploitation also requires an end user to be presented with the resulting default consent page, where the stored value is rendered without HTML entity encoding.
Is a default configuration affected?
Yes. The vulnerable component is Spring Authorization Server's DefaultConsentPage, so deployments relying on the provided default consent page are affected.