Description

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Spring Authorization Server 1.5.0 - 1.5.8 Spring Authorization Server 1.4.0 - 1.4.11

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-27T20:17:57.667Z",
  "pubdate": "2026-08-27T20:17:57.667Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the DefaultConsentPage of Spring Authorization Server, allowing for the injection of malicious payloads into the consent interface.\nThe vulnerability stems from the failure to properly encode user-controlled values rendered during the OAuth2 authorization flow.\nAffected products include Spring Authorization Server versions 1.5.0 through 1.5.8 and 1.4.0 through 1.4.11.\nSuccessful exploitation permits an attacker to execute arbitrary JavaScript in the victim's browser session when they interact with the crafted consent page.\nThis may result in session hijacking, unauthorized access to user data, or unauthorized actions performed on behalf of the authenticated user.\nThe attack vector is network-based and requires the victim to trigger a maliciously crafted OAuth2 authorization request, leading to the rendering of the tainted consent page.",
  "technicalDetails": "The vulnerability is a reflected/stored Cross-Site Scripting (XSS) flaw located in the DefaultConsentPage component of the Spring Authorization Server.\nThe root cause of this vulnerability is the lack of context-aware HTML entity encoding for user-provided parameters within the OAuth2 authorization request. When these parameters are processed by the server and subsequently rendered on the consent page, the application fails to neutralize HTML markup or script tags contained within the input.\nThe attack flow begins when an attacker crafts a malicious OAuth2 authorization request containing an XSS payload injected into a field that the DefaultConsentPage is designed to display, such as the client name or scope descriptions. This request is presented to an end user through a link or a malicious redirect.\nUpon receiving the request, the Spring Authorization Server processes the input and stores the malicious values server-side or embeds them into the generated response for the consent page. When the victim’s browser renders the consent page, the unencoded JavaScript payload is executed within the security context of the origin where the Spring Authorization Server is hosted.\nThe vulnerability is specifically present in Spring Authorization Server versions 1.5.0-1.5.8 and 1.4.0-1.4.11. The scope of exposure includes any deployment utilizing the DefaultConsentPage implementation without custom sanitization logic.\nExploitation does not require prior authentication by the attacker, but it does require the victim to be authenticated or proceed through the authorization flow to the point where the consent page is generated and rendered by the browser.\nThe post-exploitation impact includes the ability for the attacker to read document content, exfiltrate session cookies if the HttpOnly flag is missing or incorrectly configured, or perform actions as the victim user within the authorization server's session context. Because the script executes in the user's browser, the attacker can effectively bypass Same-Origin Policy (SOP) constraints to interact with the server's API endpoints via the victim's authenticated session."
}