CVE-2026-47877highCWE-79

CVE-2026-47877: falha de alta gravidade em Spring Security

Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)

Publicada em

Seguir esta CVE+ Monitorar Spring Security

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.2epss 0.3%
Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Produtos afetados
Spring · Spring Security
CVEs relacionadas — Spring Security

No mesmo produto, das mais perigosas para as menos.

CVE-2019-3795LOWInsecure Randomness When Using a SecureRandom Instance Constructed by Spring SecurityEPSS 1.9%CVE-2019-11272—PlaintextPasswordEncoder authenticates encoded passwords that are nullEPSS 1.4%CVE-2024-22234HIGHCVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticatedEPSS 0.7%CVE-2025-41232CRITICALCVE-2025-41232: Spring Security authorization bypass for method security annotations on private methodsEPSS 0.6%CVE-2025-22228HIGHCVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password lengthEPSS 0.6%CVE-2025-22223MEDIUMCVE-2025-22223EPSS 0.5%