EUVD-2026-35888
GHSA-4r8w-73jc-3m7q
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (vmware) · only source for this CVE.
CVSS VectorVendor: vmware
Lifecycle Timeline
2Blast Radius
ecosystem impact- 19 maven packages depend on org.springframework.security:spring-security-oauth2-authorization-server (4 direct, 15 indirect)
Ecosystem-wide dependent count for version 7.0.0.
DescriptionCVE.org
Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, which can lead to an Open Redirect vulnerability.
Affected versions: Spring Security 7.0.0 through 7.0.5. Spring Authorization Server 1.5.0 through 1.5.7.
AnalysisAI
Spring Authorization Server's authorization endpoint fails to adequately validate the OAuth2/OIDC request_uri parameter, enabling unauthenticated remote attackers to craft authorization requests that bypass redirect URI validation entirely. Affected deployments running Spring Authorization Server 1.5.0-1.5.7 or Spring Security 7.0.0-7.0.5 can be exploited to redirect authenticated users to attacker-controlled destinations, a particularly elevated risk given that victims inherently trust the authorization server's domain during OAuth login flows. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
Spring Authorization Server is VMware/Broadcom's implementation of the OAuth 2.0 Authorization Server and OpenID Connect 1.0 specifications for the Spring ecosystem. The request_uri parameter is defined in RFC 9101 (JWT-Secured Authorization Requests, JAR) and RFC 9126 (Pushed Authorization Requests, PAR), allowing clients to reference a pre-registered or pre-pushed request object rather than inlining parameters. The root cause is CWE-601 (URL Redirection to Untrusted Site): when an invalid request_uri is submitted, the authorization endpoint's fallback or error-handling logic fails to enforce validation of the accompanying redirect_uri against the client's registered redirect URI allowlist. This breaks a core OAuth2 security guarantee - that redirect destinations must be pre-registered - enabling an attacker to substitute an arbitrary destination URI. The CVSS Changed Scope (S:C) reflects the trust boundary violation inherent in redirecting users away from the authorization server's security context.
RemediationAI
Upgrade Spring Authorization Server beyond 1.5.7 and Spring Security beyond 7.0.5 per the vendor advisory at https://spring.io/security/cve-2026-41008. Exact fixed version numbers were not specified in the available intelligence data and must be confirmed directly from the advisory before deployment. If immediate patching is not feasible, enforce strict redirect_uri allowlisting at the application gateway or reverse proxy layer to reject authorization requests containing redirect_uri values not matching pre-registered client URIs - note this may require access to client registration data and could break legitimate dynamic redirect flows. Additionally, implement monitoring or WAF rules to flag authorization endpoint requests that include both a request_uri parameter and a redirect_uri parameter simultaneously, as this combination is the exploitation vector. Restricting the authorization endpoint to known IP ranges is a blunt compensating control that trades availability for risk reduction if the deployment context allows it.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Share
External POC / Exploit Code
Leaving vuln.today