CVE-2016-4977: Spring Security OAuth Remote Code Execution
Summary
CVE-2016-4977: When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user t... Affects org.springframework.security.oauth:spring-security-oauth2 across 2 version ranges.
>= 1.0.0, < 1.0.5
>= 2.0.0, < 2.0.10
Fixed in 1.0.5 or 2.0.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The package under scrutiny is org.springframework.security.oauth:spring-security-oauth2, which is a Maven package. Spring Security OAuth is a library that provides support for OAuth 2.0 authentication and authorization in Spring applications. It allows developers to secure their applications by integrating with OAuth 2.0 providers. However, versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 of this package are vulnerable to remote code execution (RCE) via specially crafted requests using whitelabel views.
Vulnerability Detail
The vulnerability (CVE-2016-4977) arises from the processing of authorization requests using the whitelabel views in Spring Security OAuth. The response_type parameter value is executed as Spring SpEL, which enables a malicious user to trigger remote code execution by crafting the value for response_type. This vulnerability has a CVSS score of 8.8 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The impact of this vulnerability can be severe, as it allows an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, or further compromise of the system.
How To Fix
Latest published version: 2.5.2.RELEASE as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 1.0.51.0.5 -
>= 2.0.0, < 2.0.102.0.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a non-vulnerable version of the package.
Conclusion
In conclusion, the org.springframework.security.oauth:spring-security-oauth2 package is vulnerable to remote code execution (RCE) via specially crafted requests using whitelabel views. This vulnerability can have severe consequences, including unauthorized access, data breaches, and system compromise. It is crucial to upgrade to version 2.0.10 or higher of the package to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.springframework.security.oauth:spring-security-oauth2 →
FAQ
The vulnerability allows an attacker to execute arbitrary code on the affected system, potentially leading to unauthorized access, data breaches, or further compromise of the system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
No, only versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 of the package are vulnerable to this remote code execution vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to upgrade to a non-vulnerable version of the package.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-7q9c-h23x-65fq/GHSA-7q9c-h23x-65fq.json).
Related vulnerabilities
Recent vulnerabilities recorded for org.springframework.security.oauth:spring-security-oauth2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
