Spring Authorization Server’s DefaultConsentPage renders user‑controlled values without HTML‑entity encoding, allowing an attacker who can craft an OAuth2 authorization request to embed malicious script. The request value is stored server‑side and later displayed unencoded on the consent page presented to the end user, enabling arbitrary JavaScript execution in the user’s browser. This can lead to session hijacking, token theft, or other client‑side attacks. The weakness is a classic cross‑site scripting flaw.

The vulnerability affects Spring Authorization Server 1.4.0 through 1.4.11 and 1.5.0 through 1.5.8. All deployments using the DefaultConsentPage template in these version ranges are susceptible. Versions prior to 1.4.0 or later than 1.5.8 are not impacted by this specific issue.

The CVSS score of 8.2 denotes high severity, but the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is an OAuth2 client externally issuing an authorization request that includes a malicious value. Exploitation requires the user to view the consent page, but once visible the attacker can run script under the user’s context. The risk is significant for organizations that rely on the default consent page; mitigating actions involve patching to a fixed release or re‑implementing the page with proper encoding.