Warning: Authentication bypass in Spring Security Spring Authorization Server Patch Immediately!

A newly discovered vulnerability in Spring Authorization Server allows attackers with a valid Initial Access Token to register malicious clients through Dynamic Client Registration, potentially exposing sensitive company data and disrupting operations.

Spring Authorization Server is a widely deployed authentication and authorization framework used by organizations to secure user logins, issue access tokens, and control which applications can reach internal systems and data.

If exploited this could lead to data breaches, system compromise, and operational downtime impacting confidentiality, integrity, and availability of critical businesses.

A critical security vulnerability, CVE-2026-22752, has been identified in Spring Authorization Server versions 1.3.0 through 1.3.10, 1.4.0 through 1.4.9, 1.5.0 through 1.5.6, and 7.0.0 through 7.0.4. This flaw arises from insufficient validation of client metadata fields, a type of vulnerability that allows attackers to submit crafted values that the server later trusts and processes, potentially leading to unauthorized actions such as Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).

In affected versions, an attacker can exploit this vulnerability by using a valid Initial Access Token to dynamically register a malicious client with crafted metadata, leading to one or more of the impacts above depending on the metadata supplied and the Authorization Server's configuration. Notably, exploitation is only possible where the Dynamic Client Registration endpoints have been explicitly enabled, as they are disabled by default, and requires the attacker to already possess a valid Initial Access Token.

Patch The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority, after thorough testing.

Monitor/Detect The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity, ensuring a swift response in case of an intrusion. In case of an intrusion, you can report an incident via: .

While patching appliances or software to the newest version may provide safety from future exploitation, it does not remediate historic compromise.