CVE-2026-59354
Last modified
CVE-2026-59354 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possesses a valid Initial Access Token can register a malicious client with crafted metadata, which, depending on server configuration and how the metadata is later rendered or used, may result in Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).. EPSS estimates a 0.37% chance of exploitation in the next 30 days.
Description
In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possesses a valid Initial Access Token can register a malicious client with crafted metadata, which, depending on server configuration and how the metadata is later rendered or used, may result in Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Vmware | Spring Security | >= 7.0.0, < 7.0.5 |
References
- https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N&version=3.1US Government Resource, Third Party Advisory
- https://spring.io/security/cve-2026-59354Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-59354?
How severe is CVE-2026-59354?
How do I fix CVE-2026-59354?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-59327Spring Tools for Eclipse stores the Spring Boot DevTools rem…4.4
- CVE-2026-59328Spring Tools for Eclipse renders Spring Boot starter wizard …4.2
- CVE-2026-59335Improper handling of case sensitivity (CWE-178) in the ident…8.7
- CVE-2026-5934The WP Rocket plugin for WordPress is vulnerable to Stored C…7.2
- CVE-2026-59341A security vulnerability exists in the Sealed Secrets contro…4.2
- CVE-2026-5935IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9…9.8
- CVE-2026-59355In versions of Spring Authorization Server 1.5.0 through 1.5…6.1
- CVE-2026-5936An attacker can control a server-side HTTP request by supply…9.8
- CVE-2026-5937Insufficient parameter verification leads to the occurrence …5.5
- CVE-2026-5938Improper control flow management allows a crafted document a…5.5
- CVE-2026-5939A crafted XFA PDF can trigger a use-after-free condition dur…5.5
- CVE-2026-5940Calling a function that triggers a UI refresh after removing…5.5
Are you affected by CVE-2026-59354?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST