Broadcom Spring Authorization Server — known CVE vulnerabilities

Every CVE whose affected-product data names Broadcom Spring Authorization Server, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (4)

• CVE-2026-22752 — CVSS 9.6 (critical): Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring…
• CVE-2026-59316 — CVSS 8.2 (high): Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the…
• CVE-2026-41008 — CVSS 6.1 (medium): Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker…
• CVE-2026-59355 — CVSS 6.1 (medium): In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the…