CVE-2026-47877 - Vulnerability Details - OpenCVE

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Spring	Spring Security
Vmware	Spring Security

Configuration 1 [-]

OR	cpe:2.3:a:vmware:spring_security::::::::
	cpe:2.3:a:vmware:spring_security::::::::

No data.

References

Link	Providers
https://spring.io/security/cve-2026-47877

History

Wed, 02 Sep 2026 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Vmware Vmware spring Security
CPEs		cpe:2.3:a:vmware:spring_security::::::::
Vendors & Products		Vmware Vmware spring Security

Thu, 27 Aug 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 27 Aug 2026 07:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Spring Spring spring Security
Weaknesses		CWE-79
Vendors & Products		Spring Spring spring Security

Thu, 27 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6
Title		Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
References		https://spring.io/security/cve-2026-47877
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: vmware

Published: 2026-08-27T05:20:22.523Z

Updated: 2026-08-27T14:43:11.105Z

Reserved: 2026-05-20T10:00:58.694Z

Link: CVE-2026-47877

Vulnrichment

Updated: 2026-08-27T14:42:49.594Z

NVD

Status : Analyzed

Published: 2026-08-27T06:17:17.490

Modified: 2026-09-02T15:23:27.810

Link: CVE-2026-47877

Redhat

No data.

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47877", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-27T14:41:08.906167Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-27T14:42:49.594Z"}}], "cna": {"title": "Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)", "source": {"discovery": "UNKNOWN"}, "impacts": [{"descriptions": [{"lang": "en", "value": "Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding."}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Spring", "product": "Spring Security", "versions": [{"status": "affected", "version": "7.1.0", "versionType": "custom"}, {"status": "affected", "version": "7.0.0", "versionType": "custom", "lessThanOrEqual": "7.0.6"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://spring.io/security/cve-2026-47877"}], "descriptions": [{"lang": "en", "value": "Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6", "supportingMedia": [{"type": "text/html", "value": "<p>Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding.</p><p>Spring Security 7.1.0<br/>Spring Security 7.0.0 - 7.0.6</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "shortName": "vmware", "dateUpdated": "2026-08-27T05:21:29.496Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47877", "state": "PUBLISHED", "dateUpdated": "2026-08-27T14:43:11.105Z", "dateReserved": "2026-05-20T10:00:58.694Z", "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d", "datePublished": "2026-08-27T05:20:22.523Z", "assignerShortName": "vmware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Spring Security", "vendor": "Spring", "versions": [{"status": "affected", "version": "7.1.0", "versionType": "custom"}, {"lessThanOrEqual": "7.0.6", "status": "affected", "version": "7.0.0", "versionType": "custom"}]}], "source": "security@vmware.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "DD15AD30-A708-4484-B0E2-601254C7341E", "versionEndExcluding": "7.0.6.1", "versionStartIncluding": "7.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*", "matchCriteriaId": "ABC35A3B-2FE4-4ACC-AD66-F1EE62086E08", "versionEndExcluding": "7.1.0.1", "versionStartIncluding": "7.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding.\nSpring Security 7.1.0\nSpring Security 7.0.0 - 7.0.6"}], "id": "CVE-2026-47877", "lastModified": "2026-09-02T15:23:27.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "security@vmware.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47877", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-27T14:41:08.906167Z", "version": "2.0.3"}}]}, "published": "2026-08-27T06:17:17.490", "references": [{"source": "security@vmware.com", "tags": ["Vendor Advisory"], "url": "https://spring.io/security/cve-2026-47877"}], "sourceIdentifier": "security@vmware.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}