Executive brief
Spring Authorization Server's default consent page fails to properly encode user-controlled values, allowing attackers to inject malicious scripts. When an organization uses Spring Authorization Server to manage OAuth2 authentication flows, an attacker can craft a malicious authorization request that executes JavaScript in the browser of users who see the consent page, potentially stealing session tokens or credentials.
Technical details
This is a reflected/stored cross-site scripting (XSS) vulnerability in the DefaultConsentPage component of Spring Authorization Server. The vulnerability occurs because user-controlled OAuth2 authorization request parameters are rendered into the consent page HTML without HTML entity encoding. An attacker crafts a malicious OAuth2 authorization request containing JavaScript payloads; these values are stored server-side and later rendered unencoded to the user. The attack requires the user to visit a malicious authorization link and view the consent page, but does not require prior authentication. An attacker can execute arbitrary JavaScript in the context of the authorization server, compromising user sessions or stealing authorization credentials.
Affected products
- VMware Spring Authorization Server 1.4.0 to 1.4.11, 1.5.0 to 1.5.8
Timeline
- 2026-08-27: disclosed