Critical Spring Authorization Server Issue Exposes Systems to XSS and SSRF Attacks

A critical vulnerability, tracked as CVE-2026-22752, has been disclosed in Spring Security Authorization Server, affecting organizations running Dynamic Client Registration endpoints.

The flaw allows attackers to inject malicious client metadata, potentially leading to Stored Cross-Site Scripting (XSS), Privilege Escalation, and Server-Side Request Forgery (SSRF) attacks.

The vulnerability was responsibly reported by security researcher Kelvin Mbogo and officially disclosed on April 21, 2026, by the Spring Security team.

When explicitly enabled, Spring Authorization Server’s Dynamic Client Registration feature performs insufficient validation of certain client metadata fields. An attacker who possesses a valid Initial Access Token can exploit this weakness by dynamically registering a malicious OAuth client with specially crafted metadata.

Depending on the server’s configuration and the metadata supplied, this can result in:

• Stored XSS – injecting persistent malicious scripts into the Authorization Server
• Privilege Escalation – gaining unauthorized elevated permissions within the system
• SSRF – forcing the server to make internal requests, potentially exposing backend infrastructure

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) indicates a network-exploitable, low-complexity attack that requires only low-level privileges, posing a serious risk in any internet-facing deployment.

The following Spring products are confirmed vulnerable:

• Spring Security: 7.0.0 – 7.0.4
• Spring Authorization Server: 1.3.0 – 1.3.10, 1.4.0 – 1.4.9, 1.5.0 – 1.5.6

Spring has released patched versions addressing the flaw. Administrators should upgrade immediately:

• Spring Security 7.0.x → upgrade to 7.0.5 (OSS)
• Spring Authorization Server 1.3.x → upgrade to 1.3.11 (Commercial)
• Spring Authorization Server 1.4.x → upgrade to 1.4.10 (Commercial)
• Spring Authorization Server 1.5.x → upgrade to 1.5.7 (OSS)

Organizations using commercial builds can access fixes through Spring Enterprise.

OAuth-based Authorization Servers sit at the heart of modern application authentication flows. A compromised Authorization Server can cascade into full organizational account takeover, lateral movement across services, and the exfiltration of sensitive data.

The combination of stored XSS and SSRF in a single exploit path makes CVE-2026-22752 particularly dangerous for cloud-native and microservice environments.

Security teams are strongly advised to audit all deployments using Dynamic Client Registration and apply patches without delay. If immediate patching is not feasible, disabling Dynamic Client Registration endpoints is a viable temporary mitigation.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.