EUVD-2026-35888
GHSA-4r8w-73jc-3m7q
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, which can lead to an Open Redirect vulnerability.
Affected versions: Spring Security 7.0.0 through 7.0.5. Spring Authorization Server 1.5.0 through 1.5.7.
AnalysisAI
Spring Authorization Server's authorization endpoint fails to adequately validate the OAuth2/OIDC request_uri parameter, enabling unauthenticated remote attackers to craft authorization requests that bypass redirect URI validation entirely. Affected deployments running Spring Authorization Server 1.5.0-1.5.7 or Spring Security 7.0.0-7.0.5 can be exploited to redirect authenticated users to attacker-controlled destinations, a particularly elevated risk given that victims inherently trust the authorization server's domain during OAuth login flows. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The authorization endpoint must be network-accessible, which is the standard and expected deployment posture for any OAuth2/OIDC authorization server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 Medium score is composed of network attack vector (AV:N), low complexity (AC:L), no required privileges (PR:N), required user interaction (UI:R), changed scope (S:C), and low confidentiality and integrity impact (C:L/I:L/A:N). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker constructs a malicious OAuth2 authorization URL targeting a vulnerable Spring Authorization Server, embedding a syntactically invalid `request_uri` value alongside an attacker-controlled `redirect_uri` pointing to a credential-harvesting page styled to mimic a legitimate post-authentication destination. The attacker delivers this URL via a phishing email to users of an application that relies on the affected authorization server; when a victim clicks the link and completes authentication, the server - having failed to validate the redirect destination - sends the victim's browser to the attacker's site, where tokens, session state, or credentials can be captured. … |
| Remediation | Upgrade Spring Authorization Server beyond 1.5.7 and Spring Security beyond 7.0.5 per the vendor advisory at https://spring.io/security/cve-2026-41008. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Credential leakage in Erlang/OTP's inets httpc client (versions 17.0 through 29.0.2, 28.5.0.2, and 27.3.4.13) allows att
Open redirect in hs-web hsweb-framework's OAuth2Client component (versions up to 5.0.1) allows remote unauthenticated at
Host header injection in HCL Digital Experience and HCL Digital Experience Compose enables unauthenticated remote attack
Open redirect in WebOb (pip/webob <= 1.8.9) enables unauthenticated network attackers to redirect victims to arbitrary a
Open redirect in Spring Security's cookie-based saved-request components allows remote unauthenticated attackers to redi
Share
External POC / Exploit Code
Leaving vuln.today