When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_t

Summary

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.

Timeline

1. May 25, 2017, 5:00 PM UTCCVE published
2. Aug 6, 2024, 12:46 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• Pivotal Spring Security OAuth

  2.0.0 to 2.0.9, 1.0.0 to 1.0.5

• org.springframework.security.oauth:spring-security-oauth2Maven

  From 2.0.0 · fixed in 2.0.10

• org.springframework.security.oauth:spring-security-oauth2Maven

  From 1.0.0 · fixed in 1.0.5

References 10