Total
4 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-22752 | 1 Broadcom | 1 Spring Authorization Server | 2026-09-04 | N/A | 9.6 CRITICAL |
| Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10. | |||||
| CVE-2026-59355 | 1 Broadcom | 1 Spring Authorization Server | 2026-09-01 | N/A | 6.1 MEDIUM |
| In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site. | |||||
| CVE-2026-59316 | 1 Broadcom | 1 Spring Authorization Server | 2026-08-31 | N/A | 8.2 HIGH |
| Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page presented to the end user. Spring Authorization Server 1.5.0 - 1.5.8 Spring Authorization Server 1.4.0 - 1.4.11 | |||||
| CVE-2026-41008 | 2 Broadcom, Vmware | 2 Spring Authorization Server, Spring Security | 2026-07-23 | N/A | 6.1 MEDIUM |
| Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, which can lead to an Open Redirect vulnerability. Affected versions: Spring Security 7.0.0 through 7.0.5. Spring Authorization Server 1.5.0 through 1.5.7. | |||||