Threat database

CVE-2026-59354 is a critical vulnerability in Spring Security's OAuth2 Authorization Server module versions 7.0.0 through 7.0.4. When Dynamic Client Registration is enabled, the registration endpoint inadequately validates certain client metadata fields. An attacker with a valid Initial Access Token can register a malicious client with crafted metadata, potentially leading to Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF) depending on server configuration and metadata usage.