CVE-2026-59316: Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker…

PriorityP348high8.2CVSS 3.1

AVNACLPRNUIRSCCHILAN

EPSS

0.32%

23.6th percentile

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Spring Authorization Server 1.5.0 - 1.5.8 Spring Authorization Server 1.4.0 - 1.4.11

Affected

4 ranges

Vendor	Product	Version range	Fixed in
broadcom	spring_authorization_server	>= 1.4.0 < 1.4.12	1.4.12
broadcom	spring_authorization_server	>= 1.5.0 < 1.5.9	1.5.9
spring	spring_authorization_server	1.4.0 – 1.4.11	—
spring	spring_authorization_server	1.5.0 – 1.5.8	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.