Executive Summary
A vulnerability in Spring Security Authorization Server's default consent page allows an attacker to inject user-controlled values without HTML entity encoding, potentially leading to XSS attacks. Affected versions include Spring Security 7.1.0 and 7.0.0-7.0.6. The CVSS score is 8.2, indicating a high severity vulnerability.
Technical Analysis
The vulnerability class is Cross-Site Scripting (XSS) due to insufficient HTML entity encoding of user-controlled values on the default consent page. The attack vector involves an attacker convincing a user to interact with a maliciously crafted link or page that injects malicious JavaScript code. The root cause is the lack of proper input validation and encoding.
How It Gets Exploited
An attacker would craft a malicious link or page that, when interacted with by an authenticated user, injects JavaScript code into the consent page. This could be achieved by sending a specially crafted URL that includes the malicious code, which is then rendered without proper encoding. Upon user interaction, the code executes, potentially allowing the attacker to steal session tokens, perform actions on behalf of the user, or deface the page.
Impact Assessment
Affected products include Spring Security versions 7.1.0 and 7.0.0 through 7.0.6. An attacker could achieve confidentiality impact by stealing user data or session tokens and integrity impact by defacing pages or performing unauthorized actions. The CVSS score of 8.2 indicates a high severity vulnerability with a significant impact.
Recommended Actions
Update Spring Security to version 7.1.1 or later, or 7.0.7 or later for versions 7.0.x. Implement additional security measures such as Content Security Policy (CSP) and ensure that any user-controlled input is properly encoded and validated. Monitor for suspicious activity on the consent page and consider using a Web Application Firewall (WAF) to detect and prevent XSS attacks.
Sources
- National Vulnerability Database (NVD)
- Spring Security CVE-2026-47877 Details