Spring Security OAuth2 Insufficient Client Metadata Validation

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possesses a valid Initial Access Token can register a malicious client with crafted metadata, which, depending on server configuration and how the metadata is later rendered or used, may result in Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-59354 represents a critical vulnerability in Spring Security's OAuth2 Authorization Server (versions 7.0.0-7.0.4) where the Dynamic Client Registration endpoint fails to properly validate client metadata fields. An authenticated attacker with a valid Initial Access Token can exploit this gap to register a malicious OAuth2 client with crafted metadata that bypasses security controls. This vulnerability is particularly dangerous because it affects the OAuth2 registration flow—a foundational trust mechanism—allowing attackers to potentially inject malicious content through metadata fields that are later rendered in web contexts, leading to Stored Cross-Site Scripting (XSS). Organizations using affected Spring Security versions with Dynamic Client Registration enabled face immediate risk of account compromise, credential theft, and lateral movement within federated identity ecosystems.

Casky's 323 matched security skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance). Practitioners using Casky would observe findings focused on: (1) abnormal OAuth2 client registration requests with suspicious metadata payloads containing script tags or encoded XSS vectors in fields like redirect_uri, client_name, or logo_uri; (2) detection of Initial Access Token usage patterns deviating from legitimate registration workflows; (3) post-registration behavior anomalies where crafted metadata is rendered in authentication prompts or consent screens, triggering stored XSS execution. The platform's skills would flag these patterns during both proactive threat hunting and incident investigation, enabling teams to identify compromised registrations before attackers pivot to session hijacking or credential harvesting attacks.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-59354.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-59354

Casky has 323 skills that investigate the attack patterns behind CVE-2026-59354. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn