A serious vulnerability has been discovered in Spring Authorization Server, tracked as CVE-2026-22752, putting enterprise authentication systems at risk of multi-layered exploitation.
The flaw impacts systems using Dynamic Client Registration in OAuth workflows—a feature widely used in modern cloud-native authentication architectures.
Reported by researcher Kelvin Mbogo and disclosed by the Spring Security team on April 21, 2026, this issue is not a simple bug.
It combines:
- Stored Cross-Site Scripting (XSS)
- Privilege escalation
- Server-Side Request Forgery (SSRF)
👉 All within a single exploit chain.
What Is CVE-2026-22752?
CVE-2026-22752 is a high-impact security vulnerability affecting Spring Security Authorization Server when Dynamic Client Registration is enabled.
Core Issue:
Improper validation of client-supplied metadata during OAuth client registration.
Why This Vulnerability Is So Dangerous
OAuth authorization servers are the central identity layer in modern applications.
If compromised, attackers can:
- Take over user sessions
- Manipulate authentication flows
- Access internal services
- Pivot across microservices architectures
How the Attack Works
Exploitation Flow
Attacker → Valid Initial Access Token → Malicious OAuth Client Registration → Injected Metadata → XSS + SSRF + Privilege Escalation
Step 1: Initial Access
The attacker needs a:
- Valid Initial Access Token
👉 This gives them limited but legitimate entry.
Step 2: Malicious Client Registration
Using Dynamic Client Registration, the attacker:
- Registers a rogue OAuth client
- Injects crafted metadata fields
Step 3: Exploitation Chain
The injected payload enables multiple attack types:
🔴 Stored XSS
- Malicious scripts stored in the system
- Executed in admin or UI contexts
🟠 Privilege Escalation
- Attackers gain elevated permissions
- Bypass intended access controls
🔵 SSRF Attacks
- Server is tricked into making internal requests
- Potential exposure of internal infrastructure
Why This Combination Is Dangerous
Individually, these vulnerabilities are serious.
Combined, they become a multi-stage attack chain:
- XSS → session hijacking
- SSRF → internal network discovery
- Privilege escalation → full control
👉 This creates a complete compromise pathway
Affected Versions
Spring Security
- 7.0.0 – 7.0.4
Spring Authorization Server
- 1.3.0 – 1.3.10
- 1.4.0 – 1.4.9
- 1.5.0 – 1.5.6
Patched Versions
Organizations should upgrade immediately:
- Spring Security → 7.0.5
- Authorization Server 1.3.x → 1.3.11
- Authorization Server 1.4.x → 1.4.10
- Authorization Server 1.5.x → 1.5.7
CVSS Breakdown (Why It’s High Risk)
Vector:
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
What it means:
- 🌐 Network exploitable
- 🔓 Low privilege required
- 🚫 No user interaction needed
- 💥 High impact on confidentiality and integrity
Real-World Impact Scenarios
1. Account Takeover
Attackers hijack OAuth sessions via XSS.
2. Internal Network Exposure
SSRF allows scanning internal services.
3. Microservices Compromise
Privilege escalation enables lateral movement.
4. Data Exfiltration
Sensitive tokens and identity data may be exposed.
Why OAuth Systems Are High-Value Targets
OAuth servers control:
- Authentication
- Authorization
- Token issuance
- Service-to-service identity
👉 Compromising OAuth = compromising the entire ecosystem
Common Misconceptions
❌ “OAuth is secure by design”
Only if input validation is correctly implemented.
❌ “XSS is a frontend issue”
Stored XSS in auth servers can impact backend trust models.
❌ “SSRF is low impact”
In cloud environments, SSRF often leads to credential theft.
Mitigation Strategies
1. Immediate Patch Upgrade
Upgrade to the latest fixed versions listed above.
2. Disable Dynamic Client Registration
If patching is delayed:
- Disable feature immediately
- Restrict OAuth client creation
3. Validate All Client Metadata
- Enforce strict input validation
- Sanitize all user-supplied fields
4. Monitor OAuth Activity
Watch for:
- Unexpected client registrations
- Abnormal token requests
- Metadata anomalies
5. Harden SSRF Protections
- Block internal IP ranges
- Enforce outbound request filtering
Expert Insight: Identity Layer Attacks Are Rising
This vulnerability highlights a key trend:
Attackers are increasingly targeting identity and authentication systems, not just applications.
Why?
Because identity systems provide:
- Universal access control
- Cross-service authentication
- Centralized trust
FAQs
What is CVE-2026-22752?
A critical vulnerability in Spring Authorization Server enabling XSS, SSRF, and privilege escalation.
What causes the vulnerability?
Improper validation of client metadata in Dynamic Client Registration.
Which systems are affected?
Spring Security and Spring Authorization Server versions listed above.
What is the risk?
Full compromise of OAuth authentication flows.
How can it be fixed?
Upgrade to patched versions or disable Dynamic Client Registration.
Why is SSRF dangerous here?
It allows attackers to access internal infrastructure from the server.
Conclusion: Identity Systems Are the New Attack Surface
The Spring Authorization Server vulnerability (CVE-2026-22752) is a clear reminder that modern authentication systems are prime targets.
Key Takeaways:
- OAuth servers are high-value infrastructure
- Combined XSS + SSRF + privilege escalation is highly dangerous
- Input validation failures can break trust models
- Immediate patching is critical
Organizations must treat identity systems as Tier-0 assets and prioritize their security accordingly.
