CVE-2026-59354: CWE-20: Improper Input Validation in VMware by Broadcom Spring Security (OAuth2 Authorization Server module)

This vulnerability affects Spring Security's OAuth2 Authorization Server module versions 7.0.0 through 7.0.4 when Dynamic Client Registration is explicitly enabled. The registration endpoint does not sufficiently validate client metadata fields submitted by registering clients. An attacker possessing a valid Initial Access Token can exploit this to register a malicious client with crafted metadata. The impact varies based on server configuration and how the metadata is processed or rendered, potentially enabling Stored XSS, Privilege Escalation, or SSRF attacks. The CVSS v3.1 score is 9.6 (critical), reflecting network attack vector, low complexity, required privileges, no user interaction, and high impact on confidentiality and integrity.

Successful exploitation can lead to Stored Cross-Site Scripting, allowing attackers to execute malicious scripts in the context of the affected server. Privilege Escalation may occur if the crafted metadata influences authorization decisions or client capabilities. Server-Side Request Forgery could allow attackers to make unauthorized requests from the server to internal or external systems. These impacts depend on server configuration and how the metadata is used after registration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable Dynamic Client Registration if not required or restrict access to the registration endpoint to trusted clients only. Monitor vendor channels for updates and apply official patches once released.