The vulnerability resides in the Dynamic Client Registration endpoint of Spring Security's OAuth2 Authorization Server module. When the feature is enabled, the server accepts client‑supplied metadata without performing sufficient validation. An attacker possessing a valid Initial Access Token can register a client that contains malicious content in its metadata. Depending on how that data is later rendered or processed, the flaw can lead to Stored Cross‑Site Scripting, Privilege Escalation, or Server‑Side Request Forgery.

The affected product is VMware by Broadcom's Spring Security OAuth2 Authorization Server module, versions 7.0.0 through 7.0.4. The issue occurs only when Dynamic Client Registration is explicitly enabled, and only for instances that expose the registration endpoint.

The CVSS score of 9.6 indicates high severity. Exploitation requires a valid Initial Access Token, which may originate from a separate compromise, and includes no user interaction. The EPSS score of < 1% indicates a very low probability of exploitation, and it is not listed in CISA's KEV catalog. Attacks would proceed by sending a crafted registration request to the endpoint; if the metadata is rendered into HTML or used in server‑side logic, the attacker could execute persistent XSS, elevate privileges, or force internal requests.