CVE-2026-41706

6.1 MEDIUM

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that us...

Published: 2026-06-10 · Last updated: 2026-06-10

Severity and scoring

CVSS: 6.1 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-601

Description

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is used without validation as the post-login redirect target. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

Source: NVD

References

Related CVEs

Same CWE

CVE-2026-41008 — Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter (6.1 MEDIUM)
CVE-2026-47991 — Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by an Improper Redirect (Open Redirect) vulnerability... (4.3 MEDIUM)
CVE-2026-28301 — A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website (4.8 MEDIUM)
CVE-2026-47347 — Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is use...
CVE-2026-41844 — A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an... (4.2 MEDIUM)