Spring Authorization Server CVE-2026-59355

The OAuth 2.0 authorization endpoint of Spring Authorization Server must be network-reachable by the attacker, and the server must be running versions 1.5.0 through 1.5.7. Exploitation is conditioned on the Pushed Authorization Request (request_uri) parameter pathway being reachable - if PAR support is disabled or the endpoint is not exposed, the vulnerable code path is not triggered. No authentication is required from the attacker (PR:N per CVSS). A victim user must actively follow a crafted link (UI:R per CVSS), which means automated, opportunistic mass exploitation is not feasible. Exploitation is further limited in deployments where the authorization endpoint is internal-only, accessible only to machine-to-machine clients, or where redirect_uri values are enforced by a WAF or API gateway upstream of the server.

CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C correctly captures a network-exploitable, unauthenticated flaw of low operational complexity, but one gated on user interaction. The scope change (S:C) elevates the score beyond a trivial redirect by acknowledging that the attacker influences systems external to the authorization server (e.g., phishing sites harvesting credentials for downstream services). EPSS data is absent from available intelligence, so exploitation probability cannot be quantified numerically. KEV status is not present, and no proof-of-concept code has been identified, indicating no confirmed opportunistic or targeted exploitation at time of analysis. Real-world risk is moderate-to-elevated in contexts where the authorization server is internet-facing and serves end users directly: OAuth authorization URLs are routinely shared in legitimate email flows, making weaponized links harder for users to distinguish. Environments where the authorization endpoint is internal-only or restricted to machine-to-machine clients face substantially lower practical risk.

An attacker constructs a malicious authorization URL targeting a publicly accessible Spring Authorization Server 1.5.x instance, embedding an invalid request_uri alongside a redirect_uri pointing to an attacker-controlled phishing domain. The crafted URL is distributed to targeted users via phishing email or embedded in a compromised web page, exploiting the fact that the URL's authority (the legitimate authorization server domain) appears trustworthy. When the victim clicks the link, the server fails to reject the redirect_uri and forwards the user to the attacker's site, where credentials or session tokens are harvested. No public exploit code has been identified at time of analysis.