Description

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-27T06:17:17.490Z",
  "pubdate": "2026-08-27T06:17:17.490Z",
  "executiveSummary": "The Spring Security Authorization Server contains a Cross-Site Scripting (XSS) vulnerability within its default consent page implementation.\nThe vulnerability arises due to the failure to perform proper HTML entity encoding on user-controlled input before rendering it in the browser.\nAffected versions include Spring Security 7.1.0 and 7.0.0 through 7.0.6.\nThis flaw allows a remote, unauthenticated or authenticated attacker to inject arbitrary client-side scripts into the consent page, which are then executed within the context of the user's session.\nSuccessful exploitation could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim user.\nThe risk is significant as the consent page is a critical component of the OAuth 2.0/OIDC authorization flow, and users are likely to trust the integrity of the authorization server's UI.\nRemediation requires applying the appropriate security patches provided by the Spring project to ensure all user-supplied data is appropriately sanitized or encoded before being rendered to the DOM.",
  "technicalDetails": "The root cause of this vulnerability is the improper handling of user-controllable data during the generation of the default consent page within the Spring Security Authorization Server component.\nSpecifically, the application fails to apply context-aware HTML entity encoding when rendering dynamic values sourced from request parameters or authorization state into the response body.\nIn a standard OAuth 2.0 authorization flow, the authorization server processes incoming requests that often include parameters like 'scope', 'client_id', or custom state identifiers. When the default consent page renders these values to inform the user about the requested permissions, it lacks the necessary sanitization logic to prevent the browser from interpreting injected payloads as executable content.\nAn attacker can exploit this by crafting a malicious URL containing JavaScript payloads within parameters processed by the consent page. When a victim is coerced into clicking this link, the malicious script is delivered via the legitimate Authorization Server domain.\nThe attack flow follows these steps: 1) The attacker constructs a URL targeting the Authorization Server endpoint, injecting a payload (e.g., <script>alert(document.cookie)</script>) into a parameter reflected on the consent page. 2) The victim clicks the link, initiating an authorization request. 3) The Authorization Server receives the request and renders the consent page, embedding the unencoded malicious payload into the HTML source. 4) The victim's browser parses the malicious HTML, executing the injected script within the origin of the Authorization Server. 5) The script executes, allowing the attacker to access sensitive information such as session cookies, CSRF tokens, or perform unauthorized DOM manipulation.\nBecause this vulnerability occurs on the server-side rendering path of the authorization component, it does not require the attacker to have administrative privileges. The payload execution is restricted by the browser's Same-Origin Policy (SOP), but as the script runs on the Authorization Server's origin, it can interact with any cookies or data associated with that specific domain.\nAffected versions are limited to Spring Security 7.1.0 and the 7.0.x branch (7.0.0 through 7.0.6). The vulnerability is localized to the server-side templates responsible for displaying authorization requests to users."
}