Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.springframework.security:spring-security-oauth2-authorization-server

4 known vulnerabilities (1 critical, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 1 critical, 3 medium
Dependents
16
Registry
Maven Central

Advisories 4

  • CVE-2026-59355Medium 6.1

    Spring Authorization Server: Open Redirect via request_uri parameter

    Affected: from 1.5.0, through 1.5.7.

  • CVE-2026-59354Critical 9.6

    Spring Security OAuth2 Authorization Server: Insufficient validation of Dynamic Client Registration metadata

    Affected: from 7.0.0, through 7.0.4.

  • CVE-2026-41008Medium 6.1

    Spring Security Authorization Server Open Redirect via request_uri

    Affected: from 7.0.0, fixed in 7.0.6; from 1.5.0, fixed in 1.5.8.

  • CVE-2024-22258Medium 6.1

    CVE-2024-22258: PKCE Downgrade in Spring Authorization Server

    Affected: fixed in 1.1.6; from 1.2.0, fixed in 1.2.3.