Package Health/org.springframework.security:spring-security-oauth2-authorization-server

spring-security-oauth2-authorization-server

Spring Security

Latest 7.2.0-M2org.springframework.security

Maven

84%

Total Score

healthy

Healthy, with caveats for a milestone release and concentrated recent commits.

Are you affected? Scan for Free

Health Score Breakdown

Repo bus factor

One contributor made about 79% of recent commits, creating concentration risk, although seven other contributors were active and the repository is organization-owned.

Version stability

7.2.0-M2 is a prerelease, and 30% of recent releases are prereleases, so this version carries more compatibility risk than a stable release.

Workflow audit

All 12 workflows were analyzed with no untrusted checkouts, script injection, or unpinned action references. High-confidence template-injection and secrets-inherit findings, plus four workflows with top-level write permissions, are workflow hygiene concerns but are not paired with an identified untrusted trigger or sink.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-635916 spring-security-oauth2-authorization-server is vulnerable to Cross-Site Scripting (XSS) in versions 7.0.0 - 7.0.6 and 7.1.0 - 7.1.0.	7.0.0 - 7.0.67.1.0 - 7.1.0	High
AIKIDO-2026-791233 spring-security-oauth2-authorization-server is vulnerable to Open Redirect in versions 1.5.0 - 1.5.7.	1.5.0 - 1.5.7	Medium
AIKIDO-2026-10580 spring-security-oauth2-authorization-server is vulnerable to Improper Input Validation in versions 1.3.0 - 1.5.6 and 7.0.0 - 7.0.4.	1.3.0 - 1.5.67.0.0 - 7.0.4	Critical
CVE-2024-22258 org.springframework.security:spring-security-oauth2-authorization-server is vulnerable to Improper Authentication in versions 0.0.0 - 1.1.6 and 1.2.0 - 1.2.3.	0.0.0 - 1.1.61.2.0 - 1.2.3	Medium

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
org.springframework.security:spring-security-web Version 7.2.0-M2	—	—
org.springframework.security:spring-security-oauth2-core Version 7.2.0-M2	—	—
org.springframework.security:spring-security-oauth2-jose Version 7.2.0-M2	—	—
org.springframework.security:spring-security-oauth2-resource-server Version 7.2.0-M2	—	—
org.springframework:spring-core Version 7.1.0-M2	—	—