CVE-2026-47877: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Spring Spring Security

Spring Security Authorization Server's default consent page improperly neutralizes input during web page generation, specifically failing to HTML entity encode user-controlled values. This leads to a cross-site scripting (CWE-79) vulnerability that could allow an attacker to execute scripts in the context of the victim's browser. The affected versions include 7.0.0 through 7.0.6 and 7.1.0. The CVSS v3.1 base score is 8.2, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. Confidentiality impact is high, integrity impact is low, and availability impact is none. There is no vendor advisory or patch information available at this time.

Successful exploitation can lead to execution of malicious scripts in users' browsers when they visit the vulnerable consent page, potentially compromising user confidentiality and partially affecting data integrity. There is no impact on system availability. The vulnerability requires user interaction and can be exploited remotely over the network without privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid exposing the default consent page to untrusted users or implement custom consent pages that properly encode user input. Monitor vendor communications for updates and patches.