CVE-2026-59355 In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient…

Description

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.

Affected products and versions