CVE-2026-59354: Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata
In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possesses a valid Initial Access Token can register a malicious client with crafted metadata, which, depending on server configuration and how the metadata is later rendered or used, may result in Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Security OAuth2 Authorization Server (Dynamic Client Registration metadata validation)to a version that resolves this vulnerability.Fixed in 7.0.5
Event History
Frequently Asked Questions
Which deployments are exposed?
Only Spring Security OAuth2 Authorization Server module versions 7.0.0 through 7.0.4 where Dynamic Client Registration has been explicitly enabled are described as affected. The issue concerns validation performed by the registration endpoint.
What does an attacker need to exploit this issue?
An attacker needs a valid Initial Access Token and must be able to submit crafted client metadata through Dynamic Client Registration. Exploitability and impact also depend on the server configuration and on how the supplied metadata is later rendered or used.
What impacts can unsafe metadata handling lead to?
Crafted metadata may lead to stored cross-site scripting, privilege escalation, or server-side request forgery. The described impact is conditional on the relevant metadata fields being rendered or used in an unsafe way by the deployment.