CVE-2026-47877

Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS) PUBLISHED

Description (CNA)

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6

Affected (CNA)

Vendor / product	Versions
Spring / Spring Security	affected 7.1.0; affected 7.0.0 through 7.0.6

CWE

No CWE identifiers supplied.

References

https://spring.io/security/cve-2026-47877

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.