CVE-2026-59354: CWE-20: Improper Input Validation in VMware by Broadcom Spring Security (OAuth2 Authorization Server module)

This vulnerability affects Spring Security's OAuth2 Authorization Server module versions 7.0.0 through 7.0.4 when Dynamic Client Registration is explicitly enabled. The registration endpoint does not sufficiently validate client metadata fields submitted by registering clients. An attacker possessing a valid Initial Access Token can exploit this to register a malicious client with specially crafted metadata. Depending on how the server is configured and how the metadata is rendered or utilized, this may result in Stored XSS, Privilege Escalation, or SSRF attacks. The CVSS v3.1 score is 9.6, indicating a critical severity with network attack vector, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality and integrity severely without affecting availability.

Successful exploitation allows an attacker with valid Initial Access Token privileges to register malicious clients that can execute Stored Cross-Site Scripting, escalate privileges, or perform Server-Side Request Forgery attacks. This compromises the confidentiality and integrity of the affected system and potentially its users. Availability is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is documented in the provided data. Until a patch is available, restrict or monitor the use of Dynamic Client Registration and the issuance of Initial Access Tokens to trusted entities only.