Broadcom Spring Authorization Server vulnerabilities

4 CVEs affecting Broadcom Spring Authorization Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-59316, published 2026-08-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-22752, published 2026-07-16. Critical severity, CVSS 9.6. EPSS: 0.5% chance of exploitation in the next 30 days. Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through…
CVE-2026-59316, published 2026-08-27. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization…
CVE-2026-41008, published 2026-06-10. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an…
CVE-2026-59355, published 2026-08-27. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an…