In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possesses a valid Initial Access Token can register a malicious client with crafted metadata, which, depending on server configuration and how the metadata is later rendered or used, may result in Stored Cross-Site Scripting (XSS), Privilege Escalation, or Server-Side Request Forgery (SSRF).

CVE-2026-59354 affects Spring Security's OAuth2 Authorization Server module versions 7.0.0 through 7.0.4. The vulnerability is triggered when Dynamic Client Registration is explicitly enabled, causing the registration endpoint to insufficiently validate client metadata fields. An attacker with a valid Initial Access Token can register a malicious client with crafted metadata. Depending on server configuration, this can lead to Stored XSS, Privilege Escalation, or Server-Side Request Forgery (SSRF). The CVSS v3.1 vector indicates network-accessible, low-complexity attack with low privileges required, no user interaction, and high impact on confidentiality and integrity with a changed scope. This makes it a high-severity vulnerability requiring prompt patching or mitigation.