CVE-2026-59354 is a critical flaw in the Spring Security OAuth2 Authorization Server module. With Dynamic Client Registration enabled, a holder of an Initial Access Token can register a client with crafted metadata, leading to stored XSS, privilege escalation or SSRF. Affects 7.0.0 to 7.0.4. Fixed in 7.0.5.
What's affected
- Product: Spring Security, OAuth2 Authorization Server module, versions 7.0.0 to 7.0.4.
- Fixed: 7.0.5 (open source).
- Exposed: only deployments where Dynamic Client Registration is explicitly enabled.
- Needed by the attacker: a valid Initial Access Token.
How to check if you're exposed
Check the Spring Security version and whether the registration endpoint is enabled.
./mvnw dependency:tree -Dincludes=org.springframework.security
./gradlew dependencies --configuration runtimeClasspath | grep -i spring-security
Then search your authorization server configuration for the client registration endpoint. If you never enabled Dynamic Client Registration, the advisory's precondition is not met.
If you did enable it, review who holds Initial Access Tokens, and look at the registered clients in your store for names, logo or redirect values that do not look like what your tenants would register.
What to do now
- Upgrade Spring Security to 7.0.5.
- If you cannot upgrade, disable Dynamic Client Registration.
- Review and revoke Initial Access Tokens you no longer need.
- Inspect existing registered clients for unusual metadata values, and remove suspicious ones.
- Escape or sanitise client metadata wherever your consent page or admin UI renders it.
- Run the free in-browser dependency scan on your lockfile or manifest to see every affected package in one pass.
Why it matters
The weakness is CWE-20 (Improper Input Validation). The registration endpoint did not validate certain client metadata fields enough. The advisory says the result depends on the metadata supplied and on how your server later renders or uses it: stored cross-site scripting, privilege escalation or server-side request forgery.
The record scores it 9.6 (Critical), which reflects a changed scope with high confidentiality and integrity impact. The attacker needs a valid Initial Access Token, so this is not an anonymous attack, and the endpoint must be explicitly enabled. Both limits are worth keeping in mind when you rank it. The Spring advisory shows a publication date of 21 April 2026, while the record's published date is 27 August 2026. The record does not mark it as exploited in the wild.
If you run an authorization server for other teams or tenants, this is the kind of endpoint worth reviewing even after patching. Registration metadata such as client names, logo addresses and redirect values is often rendered on consent pages, so unchecked values travel into pages that users trust.
Quick check
Do I need to act if Dynamic Client Registration is off?
The advisory only describes the issue when the feature is explicitly enabled, so exposure is much lower. Upgrading to 7.0.5 is still the clean answer.
Sources
Last reviewed: 18 October 2026.
