Spring Authorization Server (Broadcom) - vulnerabilities (CVEs)

4 CVEs, 0 in the last 30 days, 94 known versions, newest CVE from 2026-08-27. Vendor: Broadcom.

CVEs of Spring Authorization Server

• CVE-2026-59316 - CVSS 8.2 (high), 2026-08-27: Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker…
• CVE-2026-59355 - CVSS 6.1 (medium), 2026-08-27: In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An…
• CVE-2026-22752 - CVSS 9.6 (critical), 2026-07-16: Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from…
• CVE-2026-41008 - CVSS 6.1 (medium), 2026-06-10: Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious…