Skip to content
fr Sign in
6.1 Medium

CVE-2026-41008 Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri…

Description

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, which can lead to an Open Redirect vulnerability. Affected versions: Spring Security 7.0.0 through 7.0.5. Spring Authorization Server 1.5.0 through 1.5.7.

Affected products and versions

Product Affected versions Fixed in
Spring Security 7.0 7.0.0 → < 7.0.5.1 7.0.5.1
Spring Authorization Server 1.5 1.5.0 → < 1.5.7.1 1.5.7.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Spring Security

The 29 CVEs of Spring Security →
CVE-2026-59277 Spring Security's InetAddressMatchers utility provides matchInternal() and matchExternal() builders for constructing… 3.7 Low CVE-2026-59276 Several components in Spring Security compare security-sensitive values using standard string equality (String.equals())… 5.9 Medium CVE-2026-59270 Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative… 9.4 Critical CVE-2026-47877 Spring Security Authorization Server's default consent page renders user-controlled values without HTML entity encoding 8.2 High
Track this CVE