Cross-site scripting in Spring Authorization Server - CVE-2026-59316
Published: August 31, 2026
Vulnerability identifier: #VU146397
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-59316
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary script in the victim's browser.
The vulnerability exists due to cross-site scripting in the DefaultConsentPage when handling a crafted OAuth2 authorization request. A remote attacker can supply a malicious value that is stored server-side and later rendered unencoded in the default consent page to execute arbitrary script in the victim's browser.
User interaction is required because the malicious content is rendered in the consent page presented to the end user. Only applications using the default consent page are vulnerable.
Affected software
Spring Authorization Server
How to mitigate CVE-2026-59316
Install security update from vendor's website.
Spring Authorization Server - addressed in versions 1.4.12, 1.5.9