Critical Spring Authorization Server Flaw Enables XSS, Privilege Escalation, and SSRF

**Executive summary:** CVE-2026-22752 is a critical vulnerability in Spring Security Authorization Server's Dynamic Client Registration that allows attackers with a valid Initial Access Token to register malicious OAuth clients and inject metadata leading to stored XSS, SSRF, and privilege escalation; multiple Spring Security and Spring Authorization Server versions are affected and vendor patches are available (upgrade to the listed patched versions or disable Dynamic Client Registration as a temporary mitigation).