CVE-2026-59354 Overview
CVE-2026-59354 affects the Spring Security OAuth2 Authorization Server module in versions 7.0.0 through 7.0.4. When Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of client metadata fields. An attacker holding a valid Initial Access Token can register a malicious client with crafted metadata. Depending on server configuration and how the metadata is later rendered or used, exploitation may result in Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF). The flaw is tracked under [CWE-20] Improper Input Validation.
Critical Impact
Attackers with an Initial Access Token can inject unvalidated client metadata that leads to Stored XSS, SSRF, or privilege escalation within the authorization server.
Affected Products
- Spring Security OAuth2 Authorization Server 7.0.0
- Spring Security OAuth2 Authorization Server versions 7.0.1 through 7.0.3
- Spring Security OAuth2 Authorization Server 7.0.4
Discovery Timeline
- 2026-08-27 - CVE-2026-59354 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-59354
Vulnerability Analysis
The vulnerability resides in the Dynamic Client Registration endpoint exposed by the Spring Security OAuth2 Authorization Server module. Dynamic Client Registration is defined in RFC 7591 and allows clients to register themselves at runtime by submitting a JSON metadata document. The authorization server must validate this metadata before persisting or reflecting it.
In affected versions, the endpoint does not sufficiently validate several client metadata fields. Fields such as client_name, client_uri, logo_uri, policy_uri, tos_uri, jwks_uri, and redirect_uris accept content that later flows to administrative UIs, back-channel HTTP requests, or authorization decisions without adequate sanitization.
Root Cause
The root cause is missing or incomplete input validation on client-supplied metadata during registration. The registration handler accepts values that violate expected schema, encoding, or URL structure. When the server subsequently renders the metadata in a browser context, it can execute injected script content. When the server dereferences URL-typed fields for back-channel operations, it can be coerced into requesting attacker-controlled internal endpoints.
Attack Vector
Exploitation requires a valid Initial Access Token, which is used to authenticate to the Dynamic Client Registration endpoint. The attacker submits a POST request containing malicious metadata values. If the deployment renders client_name or URI fields in an admin console without contextual output encoding, injected JavaScript executes in the administrator's browser, producing Stored XSS. If the server fetches jwks_uri or similar URLs without host allowlisting, the attacker can pivot the request to internal services, producing SSRF. In configurations where client scopes or grant types are trusted from registration input, over-privileged clients may be created, enabling privilege escalation against protected resources.
No verified public exploit code is available. See the Spring Security Advisory CVE-2026-59354 for technical details.
Detection Methods for CVE-2026-59354
Indicators of Compromise
- POST requests to /connect/register or a customized Dynamic Client Registration endpoint containing HTML, JavaScript, or unusual URL schemes in metadata fields.
- Newly registered clients with client_name, logo_uri, or redirect_uris values containing <script>, javascript:, data:, or non-standard hostnames.
- Outbound HTTP requests from the authorization server to internal addresses such as 127.0.0.1, link-local, or cloud metadata endpoints following a registration event.
Detection Strategies
- Inspect application logs for registration requests and correlate them with the identity of the Initial Access Token holder.
- Alert on client records where metadata fields fail strict URL or character-set validation applied retroactively.
- Detect administrator sessions that execute unexpected script activity shortly after visiting client management pages.
Monitoring Recommendations
- Enable audit logging on the OAuth2 Authorization Server for all client registration and update operations.
- Forward authorization server logs and egress network telemetry to a centralized analytics platform for correlation.
- Monitor for unusual egress from authorization server hosts to internal network ranges and cloud instance metadata services.
How to Mitigate CVE-2026-59354
Immediate Actions Required
- Upgrade the Spring Security OAuth2 Authorization Server module to a fixed version listed in the Spring Security Advisory CVE-2026-59354.
- Disable Dynamic Client Registration if it is not required by the deployment.
- Rotate or revoke Initial Access Tokens issued while the vulnerable version was in service.
- Audit registered clients created during the exposure window and remove any with suspicious metadata.
Patch Information
Pivotal has published fixed releases in the Spring Security 7.x line. Consult the Spring Security Advisory CVE-2026-59354 for the exact fixed versions and upgrade guidance. Apply patches to all authorization server instances and rebuild dependent applications against the corrected artifacts.
Workarounds
- Restrict issuance of Initial Access Tokens to a small set of trusted administrators until patching is complete.
- Place the registration endpoint behind network controls and require mutual TLS or additional authentication.
- Add a customized OAuth2ClientRegistrationAuthenticationProvider or filter that enforces strict validation on redirect_uris, jwks_uri, logo_uri, and client_name values.
- Apply contextual output encoding in any administrative UI that renders client metadata.
# Configuration example: disable Dynamic Client Registration in Spring properties
spring.security.oauth2.authorizationserver.client-registration.enabled=false
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
