Spring Security Authorization Server provides dynamic client registration endpoints that, according to the vulnerability description, perform insufficient validation of client metadata. The flaw can enable an attacker to register or modify client entries without proper authentication, leading to unauthorized access to the authorization server. The associated weakness is classified as CWE-287, improper authentication.

Spring Security Authorization Server versions 7.0.0 through 7.0.4, 1.5.0 through 1.5.6, 1.4.0 through 1.4.9, and 1.3.0 through 1.3.10 are impacted.

The CVSS score of 9.6 indicates critical severity, but the EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. It is not listed in CISA KEV. The most likely attack vector is a remote attacker accessing the exposed registration endpoints over the network and crafting client metadata to bypass authentication; this inference is based on the described weakness and the nature of dynamic client registration endpoints.