CVE-2026-47877

Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6

  • Published Aug 27, 2026
  • CVSS 6.1 medium
  • 0.3% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-47877 at the National Vulnerability Database