Security readout for executives and security teams
Plain-English summary
A flaw in Spring Security’s OAuth2 Authorization Server can let an already-authorized client registrar submit dangerous registration data. If that data is later displayed or processed unsafely, attackers could steal privileges, inject browser content, or make the server contact unintended systems. Exposure requires Dynamic Client Registration to be explicitly enabled and the attacker to possess a valid Initial Access Token.
Executive priority
Treat confirmed exposed deployments as an urgent remediation priority because successful abuse could compromise sensitive information and authorization integrity across trust boundaries. First identify affected versions with Dynamic Client Registration enabled, then assess Initial Access Token controls and downstream metadata use. Systems lacking that feature are lower priority for this specific vulnerability.
Technical view
The Dynamic Client Registration endpoint insufficiently validates certain client metadata in spring-security-oauth2-authorization-server. Crafted metadata may create stored XSS, privilege escalation, or SSRF depending on server configuration and downstream use. The supplied description identifies versions 7.0.0 through 7.0.4 as vulnerable. CVSS 3.1 is 9.6: network-accessible, low complexity, low privileges, no user interaction, and changed scope.
Likely exposure
Likely exposure is limited to deployments using affected module versions with Dynamic Client Registration explicitly enabled. Risk increases where Initial Access Tokens are broadly issued, exposed, or insufficiently controlled, and where registered metadata is rendered, trusted for authorization, or used to initiate server-side requests. Deployments without Dynamic Client Registration are described as unaffected by this attack path.
Exploitation context
The attacker must possess a valid Initial Access Token, so this is not described as unauthenticated exploitation. The bundle reports no CISA KEV listing and provides no evidence of active exploitation. Successful impact depends on application configuration and subsequent handling of malicious client metadata; the listed outcomes are conditional rather than guaranteed.
Researcher notes
CWE-20 fits the insufficient-input-validation condition. The source bundle contains a version inconsistency: its narrative says 7.0.0–7.0.4, while the affected entry lists 7.0.0 and 7.0.5 without clear range semantics. Do not assume 7.0.5 is affected or fixed solely from that entry; resolve status through the vendor advisory. No exploit mechanics or observed campaigns are supplied.
Mitigation direction
- Check the Spring vendor advisory for the officially supported fixed release or mitigation.
- Disable Dynamic Client Registration where it is not operationally required.
- Restrict, rotate, and monitor Initial Access Tokens according to vendor guidance.
- Prevent registered metadata from being rendered unsafely or trusted for server-side requests.
- Prioritize affected internet-facing or high-privilege authorization servers.
Validation and detection
- Inventory the authorization-server package version in every deployed environment.
- Confirm whether Dynamic Client Registration is explicitly enabled.
- Review how Initial Access Tokens are issued, stored, rotated, and audited.
- Trace whether client metadata reaches HTML rendering, authorization decisions, or outbound requests.
- Verify remediation against the vendor advisory and repeat configuration review.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-20: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCloud metadata behavior lookup
The CVE wording references SSRF or metadata access, so cloud discovery and credential material review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-59354 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N3.15.8vmwareVulnerability scoring details
Base CVSS 3.1 score
9.6CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelinevmware
Public disclosure and fix released (Spring Security 7.0.5).
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- spring.ioCVE reference, vmware · vendor-advisory
- CVSS v3.1 CalculatorCVE reference, vmware · technical-description
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Input Validation
Improper Input Validation represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.