A high-severity cross-site scripting vulnerability in Spring Security Authorization Server allows unauthenticated attackers to execute malicious scripts in the context of a user session.

The vulnerability stems from the default consent page failing to perform adequate HTML entity encoding on user-supplied values. This flaw allows an unauthenticated attacker to inject malicious scripts that execute when a victim views the consent page.

This vulnerability carries a CVSS score of 8.2, reflecting its potential for significant impact on user security. Successful exploitation could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim within the authorization flow, resulting in potential data compromise and loss of user trust.

Immediate Action: Update to the latest patched version of Spring Security as specified in the official vendor security advisory.

Proactive Monitoring: Review web application logs for suspicious characters or script tags in URL parameters and request bodies associated with the authorization server.

Compensating Controls: Deploy a Web Application Firewall with cross-site scripting protection rules enabled to filter malicious input patterns before they reach the application.

Public Exploit Available: No (exploit_available: unknown)

Given the high CVSS score and the nature of cross-site scripting, organizations utilizing the Spring Security Authorization Server should prioritize patching. Apply the vendor updates immediately to eliminate the underlying input validation flaw and protect users from potential script injection attacks.