# CVE-2026-59316: Spring Authorization Server XSS in default consent page

Source: https://junglewise.ai/threats/cve-2026-59316-spring-authorization-server-xss-in-default-consent-page  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-59316 · Severity: high · CVSS 8.2 · Published 2026-08-27

Spring Authorization Server's default consent page fails to properly encode user-controlled values, allowing attackers to inject malicious scripts. When an organization uses Spring Authorization Server to manage OAuth2 authentication flows, an attacker can craft a malicious authorization request that executes JavaScript in the browser of users who see the consent page, potentially stealing session tokens or credentials.

Technologies: [VMware Spring Authorization Server](https://junglewise.ai/threats/technologies/spring-authorization-server). Vendors: [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-59316 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59316 being exploited in the wild.

**How severe is CVE-2026-59316?** High severity, with a CVSS score of 8.2, published 27 August 2026.

**Which products and versions are affected?** VMware Spring Authorization Server 1.4.0 to 1.4.11, 1.5.0 to 1.5.8.

**Is there a fix for CVE-2026-59316?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-59316 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-59316?** Check whether you run VMware Spring Authorization Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a reflected/stored cross-site scripting (XSS) vulnerability in the DefaultConsentPage component of Spring Authorization Server. The vulnerability occurs because user-controlled OAuth2 authorization request parameters are rendered into the consent page HTML without HTML entity encoding. An attacker crafts a malicious OAuth2 authorization request containing JavaScript payloads; these values are stored server-side and later rendered unencoded to the user. The attack requires the user to visit a malicious authorization link and view the consent page, but does not require prior authentication. An attacker can execute arbitrary JavaScript in the context of the authorization server, compromising user sessions or stealing authorization credentials.

## Affected products

- VMware Spring Authorization Server 1.4.0 to 1.4.11, 1.5.0 to 1.5.8

## Timeline

- 2026-08-27: disclosed

## References

- [https://spring.io/security/cve-2026-59316](https://spring.io/security/cve-2026-59316)

## Related threats

- [VMware Spring Security Authorization Server open redirect in authorization endpoint](https://junglewise.ai/threats/cve-2026-41008-vmware-spring-security-authorization-server-open-redirect-in)