Executive brief
Spring Security's OAuth2 Authorization Server module is used to implement OAuth2 authorization for applications. When Dynamic Client Registration is enabled, the registration endpoint fails to properly validate client-supplied metadata, allowing an attacker with a valid Initial Access Token to register a malicious client. This can lead to stored cross-site scripting, privilege escalation, or server-side request forgery attacks depending on how the metadata is used.
Technical details
This vulnerability is an input validation flaw in the Dynamic Client Registration endpoint of Spring Security's OAuth2 Authorization Server (versions 7.0.0 through 7.0.4). The registration endpoint accepts and stores client metadata without sufficient validation, allowing an attacker who possesses a valid Initial Access Token to craft malicious metadata fields. Depending on server configuration and how the metadata is rendered or used downstream, this can result in Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF) attacks. The vulnerability requires authentication (possession of a valid Initial Access Token) but is network-reachable. Patches are available in versions 7.0.5 and later.
Affected products
- VMware Spring Security OAuth2 Authorization Server 7.0.0 through 7.0.4
Timeline
- 2026-08-27: disclosed