CVE-2026-59316 Security Details

CVE ID

CVE-2026-59316

CWE

CWE-79

CVE Description

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Spring Authorization Server 1.5.0 - 1.5.8 Spring Authorization Server 1.4.0 - 1.4.11

Published

Aug 21, 2026

CVSS Score & Severity

5.1Medium

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

EPSS Score

0.319%

Malware

malware

KEV Status

Not in KEV Catalog: No known exploits

Vulnerable Methods

org/springframework/security/oauth2/server/authorization/web/DefaultConsentPage.generateConsentPage(Ljakarta/servlet/http/HttpServletRequest;Ljava/lang/String;Lorg/springframework/security/core/Authentication;Ljava/util/Set;Ljava/util/Set;Ljava/lang/String;Ljava/util/Map;)Ljava/lang/String;

JVM

Affected Ecosystems

affected

Source

National Vulnerability Database

References

spring.ioPROJECT