Spring Authorization Server
Monthly
Stored cross-site scripting in Spring Authorization Server's DefaultConsentPage allows network-accessible, unauthenticated attackers to inject arbitrary JavaScript into the OAuth2 consent screen presented to legitimate users. Affected versions span 1.4.0-1.4.11 and 1.5.0-1.5.8; the attack payload is embedded in a crafted OAuth2 authorization request, persisted server-side, and executed in the victim's browser when they view the consent dialog. No public exploit has been identified at time of analysis, but the low-complexity injection mechanism combined with a CVSS 8.2 base score and high confidentiality impact makes this an urgent remediation target for any deployment relying on the default consent page.
Authentication bypass in VMware/Spring's Spring Authorization Server (versions 7.0.0-7.0.4, 1.5.0-1.5.6, 1.4.0-1.4.9, and 1.3.0-1.3.10) allows a low-privileged authenticated actor to circumvent authentication controls and access protected resources across a security boundary. The CVSS 9.6 (Critical) rating reflects a scope change with high confidentiality and integrity impact but no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score in a widely deployed OAuth2/OIDC authorization component makes this a high-priority patch.
Open redirect in Spring Authorization Server 1.5.0-1.5.7 allows remote unauthenticated attackers to redirect victims to attacker-controlled sites by crafting authorization requests that pair an invalid request_uri with an unvalidated redirect_uri. The CVSS scope change (S:C) reflects that the redirect escapes the authorization server's security boundary, enabling high-trust phishing attacks because victims see the legitimate authorization server domain before being redirected. No public exploit has been identified at time of analysis, and exploitation requires user interaction.
Spring Authorization Server's authorization endpoint fails to adequately validate the OAuth2/OIDC `request_uri` parameter, enabling unauthenticated remote attackers to craft authorization requests that bypass redirect URI validation entirely. Affected deployments running Spring Authorization Server 1.5.0-1.5.7 or Spring Security 7.0.0-7.0.5 can be exploited to redirect authenticated users to attacker-controlled destinations, a particularly elevated risk given that victims inherently trust the authorization server's domain during OAuth login flows. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in Spring Authorization Server's DefaultConsentPage allows network-accessible, unauthenticated attackers to inject arbitrary JavaScript into the OAuth2 consent screen presented to legitimate users. Affected versions span 1.4.0-1.4.11 and 1.5.0-1.5.8; the attack payload is embedded in a crafted OAuth2 authorization request, persisted server-side, and executed in the victim's browser when they view the consent dialog. No public exploit has been identified at time of analysis, but the low-complexity injection mechanism combined with a CVSS 8.2 base score and high confidentiality impact makes this an urgent remediation target for any deployment relying on the default consent page.
Authentication bypass in VMware/Spring's Spring Authorization Server (versions 7.0.0-7.0.4, 1.5.0-1.5.6, 1.4.0-1.4.9, and 1.3.0-1.3.10) allows a low-privileged authenticated actor to circumvent authentication controls and access protected resources across a security boundary. The CVSS 9.6 (Critical) rating reflects a scope change with high confidentiality and integrity impact but no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score in a widely deployed OAuth2/OIDC authorization component makes this a high-priority patch.
Open redirect in Spring Authorization Server 1.5.0-1.5.7 allows remote unauthenticated attackers to redirect victims to attacker-controlled sites by crafting authorization requests that pair an invalid request_uri with an unvalidated redirect_uri. The CVSS scope change (S:C) reflects that the redirect escapes the authorization server's security boundary, enabling high-trust phishing attacks because victims see the legitimate authorization server domain before being redirected. No public exploit has been identified at time of analysis, and exploitation requires user interaction.
Spring Authorization Server's authorization endpoint fails to adequately validate the OAuth2/OIDC `request_uri` parameter, enabling unauthenticated remote attackers to craft authorization requests that bypass redirect URI validation entirely. Affected deployments running Spring Authorization Server 1.5.0-1.5.7 or Spring Security 7.0.0-7.0.5 can be exploited to redirect authenticated users to attacker-controlled destinations, a particularly elevated risk given that victims inherently trust the authorization server's domain during OAuth login flows. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.