Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:NBroadcom Spring Authorization Server
APPBroadcom1.3.0 – 1.3.11 (excl.)1.4.0 – 1.4.10 (excl.)1.5.0 – 1.5.7 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References
Related vulnerabilities
CVE-2026-59316HIGH8.2same product
Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding...
CVE-2026-59355MEDIUM6.1same product
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficie...
CVE-2026-41008MEDIUM6.1same product
Punkt autoryzacyjny Spring Security Authorization Server wykonuje niewystarczającą walidację parametru request...
CVE-2021-40438CRITICAL9.0⚠ KEVPL ✓same vendor
SSRF w mod_proxy Apache HTTP Server — przekierowanie żądań przez atakującego
CVE-2018-1273CRITICAL9.8⚠ KEVPL ✓same vendor
RCE w Spring Data Commons — podatność property bindera