Critical Spring Authorization Server Issue Exposes Systems to XSS and SSRF Attacks

**Executive Summary:** CVE-2026-22752 is a critical vulnerability in Spring Authorization Server's Dynamic Client Registration that permits attackers with a valid Initial Access Token to register malicious OAuth clients and inject metadata leading to persistent XSS, privilege escalation, and SSRF. The flaw is network-exploitable with low complexity and affects multiple Spring Security and Spring Authorization Server versions; administrators are advised to upgrade to the specified patched releases or disable Dynamic Client Registration as a temporary mitigation.