QSearchQSearch

CVE-2026-41008

6.1 MEDIUM

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter

Published: 2026-06-10 · Last updated: 2026-06-10

Severity and scoring

CVSS
6.1 MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE
CWE-601

Description

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, which can lead to an Open Redirect vulnerability. Affected versions: Spring Security 7.0.0 through 7.0.5. Spring Authorization Server 1.5.0 through 1.5.7.

Source: NVD

References

Related CVEs

Same CWE

  • CVE-2026-41706 — Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that us... (6.1 MEDIUM)
  • CVE-2026-47991 — Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability... (4.3 MEDIUM)
  • CVE-2026-28301 — A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website (4.8 MEDIUM)
  • CVE-2026-47347 — Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is use...
  • CVE-2026-41844 — A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an... (4.2 MEDIUM)