When processing authorization requests using the whitelabel views in Spring Security…
Priority HIGH 78CWE-19Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.
Summary
When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.
Why it matters now
EPSS 0.79176 99th percentileScored 2026-11-07
Fix Fixed org.springframework.security.oauth:spring-security-oauth2 (Maven): 2.0.10, 1.0.5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Pivotal | Spring Security OAuth | 2.0.0 to 2.0.9; 1.0.0 to 1.0.5 | — | No fix listed | CNA |
| — | org.springframework.security.oauth:spring-security-oauth2 (Maven) | 2.0.0 to before 2.0.10 | 2.0.10 | Patch available | GHSA-7q9c-h23x-65fq |
| — | org.springframework.security.oauth:spring-security-oauth2 (Maven) | 1.0.0 to before 1.0.5 | 1.0.5 | Patch available | GHSA-7q9c-h23x-65fq |
- Spring Security OAuth VendorPivotal Affected 2.0.0 to 2.0.9; 1.0.0 to 1.0.5 Fixed in — No fix listed CNA
- org.springframework.security.oauth:spring-security-oauth2 (Maven) Vendor— Affected 2.0.0 to before 2.0.10 Fixed in 2.0.10 Patch available GHSA-7q9c-h23x-65fq
- org.springframework.security.oauth:spring-security-oauth2 (Maven) Vendor— Affected 1.0.0 to before 1.0.5 Fixed in 1.0.5 Patch available GHSA-7q9c-h23x-65fq
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pivotal:spring_security_oauth:1.0.0:*:*:*:*:*:*:* | 1.0.0 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:1.0.1:*:*:*:*:*:*:* | 1.0.1 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:1.0.2:*:*:*:*:*:*:* | 1.0.2 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:1.0.3:*:*:*:*:*:*:* | 1.0.3 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:1.0.4:*:*:*:*:*:*:* | 1.0.4 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:1.0.5:*:*:*:*:*:*:* | 1.0.5 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:2.0.1:*:*:*:*:*:*:* | 2.0.1 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:2.0.2:*:*:*:*:*:*:* | 2.0.2 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:2.0.3:*:*:*:*:*:*:* | 2.0.3 | Vulnerable | Pivotal |
- cpe:2.3:a:pivotal:spring_security_oauth:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:1.0.1:*:*:*:*:*:*:* Versions 1.0.1 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:1.0.2:*:*:*:*:*:*:* Versions 1.0.2 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:1.0.3:*:*:*:*:*:*:* Versions 1.0.3 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:1.0.4:*:*:*:*:*:*:* Versions 1.0.4 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:1.0.5:*:*:*:*:*:*:* Versions 1.0.5 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:2.0.3:*:*:*:*:*:*:* Versions 2.0.3 Vulnerable ·Pivotal
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:pivotal:spring_security_oauth:2.0.4:*:*:*:*:*:*:* | 2.0.4 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:2.0.5:*:*:*:*:*:*:* | 2.0.5 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:2.0.6:*:*:*:*:*:*:* | 2.0.6 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:2.0.7:*:*:*:*:*:*:* | 2.0.7 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:2.0.8:*:*:*:*:*:*:* | 2.0.8 | Vulnerable | Pivotal |
| cpe:2.3:a:pivotal:spring_security_oauth:2.0.9:*:*:*:*:*:*:* | 2.0.9 | Vulnerable | Pivotal |
- cpe:2.3:a:pivotal:spring_security_oauth:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:2.0.5:*:*:*:*:*:*:* Versions 2.0.5 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:2.0.6:*:*:*:*:*:*:* Versions 2.0.6 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:2.0.7:*:*:*:*:*:*:* Versions 2.0.7 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:2.0.8:*:*:*:*:*:*:* Versions 2.0.8 Vulnerable ·Pivotal
- cpe:2.3:a:pivotal:spring_security_oauth:2.0.9:*:*:*:*:*:*:* Versions 2.0.9 Vulnerable ·Pivotal
Remediation
- Fix · GHSA-7q9c-h23x-65fq org.springframework.security.oauth:spring-security-oauth2 (Maven) Fixed in 2.0.10 Advisory →
- Fix · GHSA-7q9c-h23x-65fq org.springframework.security.oauth:spring-security-oauth2 (Maven) Fixed in 1.0.5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2016-4977
- 2026-10-03 Alias added: GHSA-7q9c-h23x-65fq
References
Advisory 3
Other 9
- [fineract-dev] 20191016 [CVE-2016-4977] Apache Fineract remote code execution vulnerabilities fixed in v1.3.0
- [fineract-dev] 20191016 Re: [CVE-2016-4977] Apache Fineract remote code execution vulnerabilities fixed in v1.3.0
- [oss-security] 20191015 Fwd: [CVE-2016-4977] Apache Fineract remote code execution vulnerabilities fixed in v1.3.0
- [announce] 20191016 [CVE-2016-4977] Apache Fineract remote code execution vulnerabilities fixed in v1.3.0
- [fineract-dev] 20191021 Re: [CVE-2016-4977] Apache Fineract remote code execution vulnerabilities fixed in v1.3.0
- https://lists.apache.org/thread.html/0841d849c23418c473ccb9183cbf41a317cb0476e44be48022ce3488@%3Cdev.fineract.apache.org%3E
- https://lists.apache.org/thread.html/37d7e820fc65a768de3e096e98382d5529a52a039f093e59357d0bc0@%3Cdev.fineract.apache.org%3E
- https://lists.apache.org/thread.html/5e6dd946635bbcc9e1f2591599ad0fab54f2dc3714196af3b17893f2@%3Cannounce.apache.org%3E
- https://lists.apache.org/thread.html/96c017115069408cec5e82ce1e6293facab398011f6db7e1befbe274@%3Cdev.fineract.apache.org%3E
More Pivotal Spring Security Oauth vulnerabilities
- TI-2022-07146 Uncontrolled resource consumption in Spring Security OAuth CVSS 3.1MEDIUM 6.5
Sources
- CVE-2016-4977 · CVE Program
- CVE-2016-4977 · NVD
- FIRST EPSS
- GHSA-7q9c-h23x-65fq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences