high8.2
CVE-2026-47877
Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding.
Impact
Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vmware | Spring Security | from 7.0.0 before 7.0.6.1 from 7.1.0 before 7.1.0.1 |