SB2026083152 - Cross-site scripting in Spring Authorization Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026083152

SB2026083152 - Cross-site scripting in Spring Authorization Server

Published: August 31, 2026

Security Bulletin ID SB2026083152
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Cross-site scripting (CVE-ID: CVE-2026-59316)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.

The vulnerability exists due to cross-site scripting in the DefaultConsentPage when handling a crafted OAuth2 authorization request. A remote attacker can supply a malicious value that is stored server-side and later rendered unencoded in the default consent page to execute arbitrary script in the victim's browser.

User interaction is required because the malicious content is rendered in the consent page presented to the end user. Only applications using the default consent page are vulnerable.


Remediation

Install update from vendor's website.

References