Description

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possesses a valid Initial Access Token can register a malicious client with crafted metadata, which, depending on server configuration and how the metadata is later rendered or used, may result in Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-08-27T10:16:36.063Z",
  "pubdate": "2026-08-27T10:16:36.063Z",
  "executiveSummary": "This vulnerability concerns insufficient validation of client metadata within the Dynamic Client Registration endpoint of Spring Security's OAuth2 Authorization Server module.\nAffected versions are 7.0.0 through 7.0.4, specifically when Dynamic Client Registration is explicitly enabled.\nThe flaw allows an attacker possessing a valid Initial Access Token to inject malicious payloads into client metadata fields.\nDepending on the downstream consumption of this metadata, the vulnerability may manifest as Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).\nThe risk implication is significant, as it enables unauthorized metadata manipulation that could compromise the integrity of administrative interfaces or lead to internal network exploitation.\nExploitation requires the attacker to already possess a valid Initial Access Token, limiting the scope to entities already authorized to perform client registration.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper input sanitization and validation of metadata fields during the Dynamic Client Registration process. When a client registers using the OAuth2 registration endpoint, the application accepts various metadata fields without sufficiently verifying their content for malicious strings or dangerous URI schemes.\nThe vulnerable component is the Dynamic Client Registration endpoint of the Spring Security OAuth2 Authorization Server module. Because the server treats the provided metadata as trusted input, it stores this information directly into the underlying configuration storage.\nThe attack flow begins when an attacker, already in possession of a valid Initial Access Token, invokes the client registration endpoint. Instead of providing benign configuration data, the attacker embeds crafted payloads within specific client metadata fields. If the application renders these fields in an administrative dashboard or an OAuth management UI without context-aware output encoding, a Stored XSS attack is triggered in the context of the administrator's session, potentially leading to unauthorized administrative actions.\nIn scenarios involving SSRF, the attacker may supply metadata fields intended for URI configuration (such as redirection URIs or discovery endpoints) that incorporate internal service addresses or malicious schemes. If the authorization server later utilizes this stored metadata to perform back-end requests, it may inadvertently reach internal infrastructure, effectively bypassing firewall perimeters.\nFurthermore, if the server logic uses the unchecked metadata to determine client permissions or scopes without secondary verification, the attacker may achieve Privilege Escalation by injecting metadata that elevates the registered client's trust level or scope access beyond intended parameters.\nThe exposure is network-based, contingent upon the availability of the registration endpoint and the presence of a valid Initial Access Token. The lack of strict schema validation and sanitization at the ingestion point ensures that the malicious metadata persists in the data store, allowing the payload to execute whenever the system retrieves and processes the corrupted client record."
}