Read the docs
TI-2026-42461 Aliases CVE-2026-59354GHSA-j9pv-5342-rrx5

Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata

Priority MEDIUM 43CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possesses a valid Initial Access Token can register a malicious client with crafted metadata, which, depending on server configuration and how the metadata is later rendered or used, may result in Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0049 42nd percentileScored 2026-11-07
Fix Fixed Spring Security (OAuth2 Authorization Server module) (VMware by Broadcom): 7.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VMware by BroadcomSpring Security (OAuth2 Authorization Server module)7.0.0 – 7.0.47.0.5Patch availableCNA
  • Spring Security (OAuth2 Authorization Server module) VendorVMware by Broadcom Affected 7.0.0 – 7.0.4 Fixed in 7.0.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*7.0.0 to before 7.0.5VulnerableVMware
  • cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* Versions 7.0.0 to before 7.0.5 Vulnerable ·VMware

Remediation

  • Fix · CNA Spring Security (OAuth2 Authorization Server module) (VMware by Broadcom) Fixed in 7.0.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59354
  2. 2026-10-03 Alias added: GHSA-j9pv-5342-rrx5

References

Advisory 2

  • TI-2023-16900 Improper access control in Spring Security CVSS 3.1CRITICAL 9.8
  • TI-2022-13611 Authorization bypass in Spring by VMware CVSS 3.1CRITICAL 9.8
  • TI-2022-07154 Incorrect authorization in Spring Security CVSS 3.1CRITICAL 9.8
  • TI-2026-42404 Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces CVSS 3.1CRITICAL 9.4
  • TI-2026-18257 Under Some Conditions Spring Security HTTP Headers Are not Written CVSS 3.1CRITICAL 9.1
  • TI-2014-02853 Improper authentication in Pivotal Spring Security CVSS 3.0CRITICAL 9.8
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences