CVE-2026-59354

Name of the Vulnerable Software and Affected Versions Spring Security OAuth2 Authorization Server versions 7.0.0 through 7.0.4

Description When Dynamic Client Registration is enabled, the registration endpoint does not sufficiently validate certain client metadata fields provided by the registering client. An attacker with a valid Initial Access Token can register a malicious client using crafted metadata. Depending on the server configuration and how this metadata is processed or rendered, this can lead to Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).

Recommendations Update Spring Security OAuth2 Authorization Server to a version later than 7.0.4. As a temporary mitigation, disable Dynamic Client Registration if it is not strictly required.