Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding.
Spring Security 7.1.0
Spring Security 7.0.0 – 7.0.6
HIGH
Vulnerability intelligence
CVE-2026-47877
CVSS 3.18.2
SeverityHigh
Known exploitedNo
NVD references:
Primary source: NIST National Vulnerability Database