EUVD-2026-35888
GHSA-4r8w-73jc-3m7q
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (vmware) · only source for this CVE.
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2Blast Radius
ecosystem impact- 19 maven packages depend on org.springframework.security:spring-security-oauth2-authorization-server (4 direct, 15 indirect)
Ecosystem-wide dependent count for version 7.0.0.
DescriptionCVE.org
Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, which can lead to an Open Redirect vulnerability.
Affected versions: Spring Security 7.0.0 through 7.0.5. Spring Authorization Server 1.5.0 through 1.5.7.
AnalysisAI
Spring Authorization Server's authorization endpoint fails to adequately validate the OAuth2/OIDC request_uri parameter, enabling unauthenticated remote attackers to craft authorization requests that bypass redirect URI validation entirely. Affected deployments running Spring Authorization Server 1.5.0-1.5.7 or Spring Security 7.0.0-7.0.5 can be exploited to redirect authenticated users to attacker-controlled destinations, a particularly elevated risk given that victims inherently trust the authorization server's domain during OAuth login flows. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Spring Authorization Server is VMware/Broadcom's implementation of the OAuth 2.0 Authorization Server and OpenID Connect 1.0 specifications for the Spring ecosystem. The request_uri parameter is defined in RFC 9101 (JWT-Secured Authorization Requests, JAR) and RFC 9126 (Pushed Authorization Requests, PAR), allowing clients to reference a pre-registered or pre-pushed request object rather than inlining parameters. The root cause is CWE-601 (URL Redirection to Untrusted Site): when an invalid request_uri is submitted, the authorization endpoint's fallback or error-handling logic fails to enforce validation of the accompanying redirect_uri against the client's registered redirect URI allowlist. This breaks a core OAuth2 security guarantee - that redirect destinations must be pre-registered - enabling an attacker to substitute an arbitrary destination URI. The CVSS Changed Scope (S:C) reflects the trust boundary violation inherent in redirecting users away from the authorization server's security context.
RemediationAI
Upgrade Spring Authorization Server beyond 1.5.7 and Spring Security beyond 7.0.5 per the vendor advisory at https://spring.io/security/cve-2026-41008. Exact fixed version numbers were not specified in the available intelligence data and must be confirmed directly from the advisory before deployment. If immediate patching is not feasible, enforce strict redirect_uri allowlisting at the application gateway or reverse proxy layer to reject authorization requests containing redirect_uri values not matching pre-registered client URIs - note this may require access to client registration data and could break legitimate dynamic redirect flows. Additionally, implement monitoring or WAF rules to flag authorization endpoint requests that include both a request_uri parameter and a redirect_uri parameter simultaneously, as this combination is the exploitation vector. Restricting the authorization endpoint to known IP ranges is a blunt compensating control that trades availability for risk reduction if the deployment context allows it.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today