CVE-2026-22752

Overview

Spring Security Authorization Server Dynamic Client Registration endpoints perform insufficient validation of client metadata

‍

Details

Module Info

• Product: Spring
• Affected packages: spring-security-oauth2-authorization-server
• Affected versions: 1.2.x; 1.3.x; 1.4.x; 1.5.x; 7.0.x
• GitHub repository: https://github.com/spring-projects/spring-authorization-server
• Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-oauth2-authorization-server

• Package manager: Maven
• Fixed In: NES for Spring
• Fix date: 04/21/2026
• Severity: Critical
• Category: Authorization Bypass

‍

Vulnerability Info

When explicitly enabled, the Dynamic Client Registration endpoints in Spring Security Authorization Server do not sufficiently validate certain fields within client metadata. An attacker who holds a valid Initial Access Token could exploit this by registering a malicious client with specially crafted metadata values. Depending on both the metadata supplied and how the Authorization Server is configured, this flaw could result in Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).

‍

Mitigation

• Only recent versions of Spring Security Authorization Server receive community support and updates. Older versions have no publicly available fixes for this vulnerability.Users of the affected components should apply one of the following mitigations:
  • Upgrade to a currently supported version of Spring Security Authorization Server.
  • Leverage a commercial support partner like HeroDevs for post-EOL security support through Never-Ending Support (NES) for Spring Security Authorization Server.
• Implement strict validation for client metadata fields in dynamic client registration to ensure only expected values are accepted.
• Configure authorization policies to limit access to dynamic client registration endpoints to trusted clients only.
• Utilize a gateway or proxy to filter requests to dynamic client registration endpoints, allowing only necessary HTTP methods and headers.

‍

Steps To Reproduce

1. ‍Set up the affected environment: Deploy a Spring Security Authorization Server with one of the affected versions in a test environment. Ensure that the Dynamic Client Registration feature is explicitly enabled in your configuration.
2. ‍Configure client metadata: Create a client registration request with intentionally malformed or incomplete metadata fields. For example, include a missing redirect_uri or an invalid client_id format‍
3. ‍Send a registration request: Send the client registration request to the Dynamic Client Registration endpoint (e.g., /oauth2/clients), ensuring that the malformed metadata is included in the request.
4. ‍Observe the response: Check the server's response to the registration request. A vulnerable version may accept the malformed metadata and return a success response, indicating insufficient validation.
5. ‍Apply the remediation: Upgrade to a fixed version of Spring Security Authorization Server as per the advisory
6. ‍Re-test the registration request: Repeat the registration request with the same malformed metadata after the upgrade. Verify that the server now rejects the request with an appropriate error message, indicating that validation is functioning correctly.