Spring Security OAuth2 EUVD-2026-66977

Dynamic Client Registration must be explicitly enabled in the Spring Security OAuth2 Authorization Server configuration - this feature requires intentional opt-in and is not active in default deployments. The attacker must additionally possess a valid Initial Access Token (the RFC 7591-defined credential authorizing client registration); without one, the registration endpoint will reject the request. The CVSS PR:L metric confirms that token possession - representing low-privilege authenticated access - is required. The specific impact realized then depends on downstream server behavior: Stored XSS requires that the crafted metadata be rendered in an HTML context such as an admin UI; SSRF requires that the server fetches client-supplied URI fields (logo_uri, jwks_uri, or policy_uri) during registration or token issuance; Privilege Escalation requires that the server fails to enforce allowed scopes or grant types at registration time. Deployments where Dynamic Client Registration is disabled are not exploitable regardless of version.

The CVSS 8.8 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable flaw requiring only low privileges - a valid Initial Access Token - but real-world risk is gated behind two explicit prerequisites: Dynamic Client Registration must be actively enabled in configuration (it is not a default behavior), and the attacker must have already obtained a valid Initial Access Token. The EPSS score of 0.25% (16th percentile) and SSVC 'Exploitation: none' designation confirm no observed active exploitation, substantially reducing urgency for unexposed deployments. A significant data quality issue exists: the provided CVSS vector encodes S:U/A:H, whereas the linked NVD calculator URL in the references encodes S:C/C:H/I:H/A:N - the scope-changed variant is more technically consistent with Stored XSS and SSRF, which inherently affect systems or users beyond the vulnerable server itself, and should be verified against the authoritative Spring advisory. Despite the low EPSS, the SSVC 'Technical Impact: total' and the breadth of exploit classes (XSS, SSRF, privilege escalation) means that organizations with Dynamic Client Registration enabled should treat this as a priority patch cycle regardless of environment size. Deployments with the feature disabled face negligible residual risk.

An attacker who has obtained a valid Initial Access Token - through credential theft, a compromised CI/CD pipeline, or insider access - submits an OAuth2 client registration request with a malicious client_name containing a JavaScript payload or a logo_uri pointing to an internal metadata service. The authorization server persists the crafted metadata without adequate validation. When an administrator later views registered clients in a management interface, the stored XSS payload executes in their browser enabling session hijacking and account takeover; alternatively, if the server fetches the logo_uri during processing, an SSRF request is issued against cloud instance metadata endpoints or internal APIs. No public proof-of-concept code has been identified at time of analysis.