CVE-2026-59316: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Spring Spring Authorization Server

Spring Authorization Server versions 1.4.0 to 1.4.11 and 1.5.0 to 1.5.8 have an improper neutralization of input vulnerability (CWE-79) in the default consent page. The vulnerability allows an attacker to inject malicious scripts via OAuth2 authorization requests because the server stores user-controlled values and renders them without HTML entity encoding. This can lead to cross-site scripting attacks when the consent page is displayed to end users.

Successful exploitation can lead to cross-site scripting, allowing an attacker to execute arbitrary scripts in the context of the user's browser session. According to the CVSS vector, the vulnerability has network attack vector, low attack complexity, no privileges required, requires user interaction, and impacts confidentiality highly, integrity partially, and no impact on availability. This can result in unauthorized disclosure of sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. There is no official fix or temporary workaround stated in the provided data. Users should monitor the Spring project advisories for updates and consider avoiding use of the DefaultConsentPage or implementing custom consent pages that properly encode user input until a fix is available.