External risk intelligence

Spring Security OAuth2 Authorization Server Dynamic Client Registration Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-59354

The vulnerability affects the Dynamic Client Registration endpoint of an OAuth2 Authorization Server. These services are commonly deployed as internet-facing components to manage authentication and authorization for external clients, making the registration endpoint a reachable surface in many production environments.

Cross-site Scripting

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the OAuth2 Authorization Server's Dynamic Client Registration feature within the Spring Security framework. When this feature is enabled, the system may not adequately validate certain client registration details. This could potentially lead to security risks such as stored cross-site scripting, privilege escalation, or server-side request forgery, depending on how the affected server is configured and uses the data.

Weak validation allows registration of malicious clients.
Affects common authentication and authorization services.
Confirm relevance and potential exposure of client registration.

Attack Path

How an attacker could exploit the issue

An attacker with a valid token can interact with the OAuth2 Authorization Server's dynamic client registration endpoint. By submitting specially crafted metadata during client registration, they can exploit insufficient validation. This malicious registration can lead to security risks when the server later processes or displays this metadata.

Requires a valid initial access token.
Triggered by crafting client registration metadata.
Risks include Stored XSS, Privilege Escalation, or SSRF.

Live Threat

Current exploitation, exposure, and threat context

When Dynamic Client Registration is enabled in Spring Security's OAuth2 Authorization Server, an attacker with an Initial Access Token could register a malicious client. This, depending on the server's configuration, may lead to stored cross-site scripting, privilege escalation, or server-side request forgery.

Sensitive client registration data at risk.
Malicious client metadata registration.
Potential for XSS, privilege escalation, SSRF.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Spring Security OAuth2 Authorization Server module is likely managed by platform or infrastructure teams responsible for identity and access management services. The first step is to identify all instances of this module, determine their reachability and business criticality, and confirm the accountable owner before planning remediation.

Own the issue: Platform/Infrastructure teams.
Verify first: Reachability and business criticality.
Action: Plan remediation with owner.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Spring Security OAuth2 Authorization Server?

It is a framework component designed to handle identity management tasks, specifically issuing tokens and managing OAuth2 clients. It acts as the gatekeeper for applications, ensuring that only authorized users and services can access protected resources. This specific module helps developers implement standardized authentication flows, making it a critical piece of infrastructure for managing secure sign-ins and service-to-service communication.

How does CWE-20 relate to CVE-2026-59354?

This vulnerability is classified as Improper Input Validation (CWE-20). In this context, it means the software fails to properly check or sanitize the metadata provided during client registration. Because the system trusts this input without verifying that it is safe, an attacker can submit malicious data that the server later treats as legitimate, potentially causing unexpected and harmful outcomes within the application.

Does any activity trigger this vulnerability?

No. A specific precondition must be met: the attacker must possess a valid Initial Access Token to interact with the registration endpoint. Furthermore, the vulnerability only triggers if Dynamic Client Registration is explicitly enabled in your configuration. If this feature is disabled, or if the registration endpoint is not active, the specific path to submit crafted metadata does not exist.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this vulnerability is likely relevant to many environments because the Dynamic Client Registration endpoint is often intentionally exposed to the internet to facilitate client onboarding. Since these services are designed to be reachable by external clients, they frequently reside on the edge of the network, increasing the potential for unauthorized interaction if the registration process is not strictly guarded.

How should I begin addressing this CVE?

Start by identifying all deployed instances of the Spring Security OAuth2 Authorization Server within your infrastructure. Once located, verify if the Dynamic Client Registration feature is currently enabled and assess the business impact of that specific service. Coordinate with your platform or identity management teams to confirm ownership, review your security configuration, and plan for necessary updates or mitigation steps.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.