# CVE-2026-47877: Spring Security Authorization Server XSS in default consent page

Source: https://junglewise.ai/threats/cve-2026-47877-spring-security-authorization-server-xss-in-default-consent-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-47877 · Severity: high · CVSS 8.2 · Published 2026-08-27

Spring Security Authorization Server's default consent page fails to encode user-controlled input, allowing attackers to inject malicious HTML or JavaScript. An attacker could craft a malicious authorization request that injects code into the consent page shown to users, potentially stealing credentials, session tokens, or triggering unwanted actions. This affects the identity and access management layer used by many enterprise applications.

Vendors: [Spring](https://junglewise.ai/threats/vendors/spring).

## Quick answers

**Is CVE-2026-47877 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47877 being exploited in the wild.

**How severe is CVE-2026-47877?** High severity, with a CVSS score of 8.2, published 27 August 2026.

**Which products and versions are affected?** Spring Security Authorization Server 7.0.0 through 7.0.6, 7.1.0.

**Is there a fix for CVE-2026-47877?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47877 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47877?** Check whether you run Spring Security Authorization Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in Spring Security Authorization Server's default consent page template. User-controlled values from authorization request parameters are rendered in HTML without proper entity encoding, allowing attackers to inject arbitrary HTML/JavaScript. The attack vector is network-based and requires no authentication; an attacker crafts a malicious authorization URL and tricks a user into visiting it. Successful exploitation allows arbitrary code execution in the user's browser within the context of the Authorization Server, potentially compromising OAuth/OIDC flows. Patches are available in Spring Security 7.0.7 and 7.1.1 and later.

## Affected products

- Spring Security Authorization Server 7.0.0 through 7.0.6, 7.1.0

## Timeline

- 2026-08-27: disclosed

## References

- [https://spring.io/security/cve-2026-47877](https://spring.io/security/cve-2026-47877)