Spring Security Authorization Server renders user‑controlled values in its default consent page without encoding them as HTML entities, enabling an attacker to inject and execute arbitrary JavaScript when the page is viewed. This flaw permits an attacker to compromise the browser session, steal cookies or tokens, and potentially deface or manipulate other users’ interactions with the authorization server. The vulnerability is a form of cross‑site scripting that can affect confidentiality, integrity, and functional availability of the authorization process. The attack vector is web‑based; an attacker who can influence the resources requested by an authenticated user can embed malicious payloads into the printed values and have them evaluated in the user’s browser.

The vulnerability impacts Spring Security releases 7.0.0 through 7.0.6 and 7.1.0.

The CVSS score of 8.2 indicates high severity, and the absence of an EPSS score and KEV listing suggests that exploitation has not yet been widely reported. Nonetheless, the flaw allows arbitrary script execution within the consent page’s context, which makes it a valuable vector for attackers to hijack sessions or deliver phishing attacks. Without an official patch or workaround provided, the safest assumption is that the vulnerability can be exploited by any party able to influence the input values that the consent page displays.