cve.bz

CVE-2016-4977

8.8 highEPSS 79%

When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.

Severity

CVSS 3.0

8.8 high
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS
79% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE
CWE-19
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-7q9c-h23x-65fqMavenorg.springframework.security.oauth:spring-security-oauth2>=2.0.0 <2.0.102.0.10
GHSA-7q9c-h23x-65fqMavenorg.springframework.security.oauth:spring-security-oauth2>=1.0.0 <1.0.51.0.5

References

Check your stackJSON