A high-severity cross-site scripting vulnerability in Spring Authorization Server allows unauthenticated attackers to execute malicious scripts in the context of an end-user session.

The vulnerability is a cross-site scripting (CWE-79) flaw where the DefaultConsentPage renders user-supplied input without proper HTML entity encoding. An unauthenticated attacker can trigger this by crafting a malicious OAuth2 authorization request that persists server-side and executes within the browser of a victim who reaches the consent page.

This vulnerability poses a significant risk to user security and data integrity. Because the attack occurs during the OAuth2 authorization flow, a successful exploit could lead to the theft of session tokens, unauthorized actions performed on behalf of the user, or the compromise of sensitive credentials. With a CVSS score of 8.2, this flaw is considered high-risk, as it facilitates unauthorized access and potential account takeover within the identity management ecosystem.

Immediate Action: Review the official Spring security advisory at https://spring.io/security/cve-2026-59316 and apply the recommended vendor patches or configuration updates as soon as they are made available.

Proactive Monitoring: Monitor application logs for suspicious OAuth2 authorization requests containing unusual characters or script tags in URL parameters.

Compensating Controls: Deploy a Web Application Firewall with strict input validation rules to block requests containing anomalous script patterns directed at the consent page endpoint.

Public Exploit Available: No — there is no confirmed public exploit or proof-of-concept available in the provided data.

Given the potential for session hijacking and credential theft during the critical authentication process, this vulnerability requires urgent attention. Organizations should prioritize updating their Spring Authorization Server instances once the vendor releases the necessary patches, as this is the only definitive way to neutralize the underlying XSS risk.