CVE-2022-31690: Privilege Escalation in spring-security-oauth2-client
Spring Security 5.6.9 and 5.7.5 released on October 31st, 2022 included a fix for CVE-2022-31690 affecting the mapping of authorized scopes in spring-security-oauth2-client. Users are encouraged to update as soon as possible.
Impact
Users who have applied the mitigation should take note of the following impact:
No authorized scopes are mapped to the principal (current user) when the Authorization Server (AS) responds to the OAuth2 Access Token Response with an empty or missing scope
parameter.
If you are affected by this vulnerability, users will not be granted any authorities beginning with SCOPE_
when the AS does not return scopes. Only the special authority ROLE_USER
…