EUVD-2026-66840
GHSA-4pq7-67mc-3rgx
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS requires no attacker privileges; victim interaction needed; scope change and high confidentiality loss match OAuth token theft potential.
Primary rating from Vendor (vmware).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6
AnalysisAI
Reflected cross-site scripting (XSS) in Spring Security's built-in OAuth2 Authorization Server consent page allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted authorization request URL. Affected versions include Spring Security 7.1.0 and 7.0.0 through 7.0.6; the consent page reflects user-controlled values (such as client name or scope parameters) directly into the HTML response without encoding. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target deployment uses Spring Security's default built-in consent page for the OAuth2 Authorization Server flow - organizations that have implemented a custom consent page controller with correct output encoding are not vulnerable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) is justified by the OAuth2-specific threat model: a successful XSS on a consent page can harvest OAuth2 authorization codes, PKCE verifiers, CSRF state tokens, or browser session cookies, any of which can enable account takeover or downstream API access under the victim's identity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade to a patched Spring Security release; the vendor advisory at https://spring.io/security/cve-2026-47877 should be consulted for the exact fixed versions, as no specific patch version number was included in the available intelligence data - patch availability is confirmed per vendor advisory but the precise fix version is not independently verified from the provided input. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all applications using Spring Security 7.0.0-7.0.6 or 7.1.0 and take affected OAuth2 authorization servers offline or restrict access to trusted networks pending remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today