CVE-2026-47877: Spring Security XSS Vulnerability

CVE-2026-47877 Overview

CVE-2026-47877 is a Cross-Site Scripting (XSS) vulnerability in the Spring Security Authorization Server. The default consent page renders user-controlled values without HTML entity encoding. An attacker can craft OAuth 2.0 authorization requests that inject script content into the consent page rendered to victims. When a user is tricked into initiating the authorization flow, the injected content executes in the browser context of the authorization server. Affected releases include Spring Security 7.1.0 and Spring Security 7.0.0 through 7.0.6. See the Spring Security Advisory CVE-2026-47877 for vendor details.

Critical Impact
Reflected XSS on the OAuth 2.0 consent page enables session token theft, consent hijacking, and phishing against authenticated users of downstream applications.

Affected Products

Spring Security 7.1.0
Spring Security 7.0.0 through 7.0.6
Applications using Spring Authorization Server's default consent page

Discovery Timeline

2026-08-27 - CVE-2026-47877 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47877

Vulnerability Analysis

The flaw is a reflected Cross-Site Scripting (XSS) issue in the default consent page shipped with Spring Security Authorization Server. During an OAuth 2.0 authorization_code flow, the authorization server presents a consent page listing the requested scopes, the client identifier, and the target state. The default template renders these parameters directly without applying HTML entity encoding on all user-controlled values.

An attacker can craft a malicious authorization request containing script payloads inside the reflected parameters. When an authenticated victim follows the crafted link, the browser executes attacker script inside the authorization server origin. This context is trusted and typically holds session cookies for identity flows.

The user interaction requirement (UI:R) reflects the need for a victim to click the crafted authorization URL. The scope change (S:C) captures that impact crosses the boundary between the OAuth relying party and the authorization server origin.

Root Cause

The consent page template treats certain request-derived values as pre-sanitized markup instead of untrusted data. Missing HTML entity encoding on rendering allows characters such as <, >, and " to break out of attribute or text contexts and inject executable script.

Attack Vector

Exploitation is network-based and requires no authentication on the authorization server. The attacker distributes a crafted OAuth authorization URL to a target user through phishing, chat, or a compromised site. When the target is logged in and reaches the consent page, the reflected payload executes. Refer to the Spring Security Advisory CVE-2026-47877 for parameter-level detail.

// No verified proof-of-concept is publicly available.
// See the vendor advisory for technical details.

Detection Methods for CVE-2026-47877

Indicators of Compromise

OAuth 2.0 authorization requests containing HTML metacharacters such as <, >, ", or javascript: in client_id, scope, state, or redirect_uri parameters.
Unexpected outbound requests from user browsers to attacker-controlled domains immediately after visiting /oauth2/authorize or the configured consent endpoint.
Consent page HTTP responses containing unescaped script tags reflected from request parameters.

Detection Strategies

Inspect web server and reverse proxy logs for requests to the authorization endpoint containing script-like tokens in query parameters.
Enable Content Security Policy (CSP) reporting on the authorization server and alert on inline-script violations originating from the consent page.
Add web application firewall rules that flag reflected metacharacters in OAuth authorization parameters.

Monitoring Recommendations

Track the running version of Spring Security across services to identify hosts on 7.1.0 or 7.0.0–7.0.6.
Alert on anomalous spikes in traffic to the OAuth authorization endpoint from unfamiliar referrers.
Correlate consent page access with subsequent token issuance events to identify hijacked flows.

How to Mitigate CVE-2026-47877

Immediate Actions Required

Upgrade Spring Security to a patched release as specified in the Spring Security Advisory CVE-2026-47877.
Inventory all services that embed Spring Authorization Server and confirm the consent page implementation in use.
Revoke and reissue OAuth client secrets and refresh tokens if suspicious consent activity is identified.

Patch Information

The vendor addresses the issue in updated Spring Security releases after the affected 7.0.x and 7.1.0 versions. Consult the Spring Security Advisory CVE-2026-47877 for the fixed version numbers and upgrade guidance.

Workarounds

Replace the default consent page with a custom implementation that applies HTML entity encoding to every rendered parameter.
Enforce a strict Content Security Policy that disallows inline scripts on the authorization server origin.
Restrict registered redirect_uri values and validate scope and client_id inputs against an allowlist before rendering.

bash

# Example: pin a patched Spring Security version in Maven
# Replace <FIXED_VERSION> with the version listed in the vendor advisory
mvn versions:set-property \
  -Dproperty=spring-security.version \
  -DnewVersion=<FIXED_VERSION>