EUVD-2026-35896
GHSA-x2r2-rvhq-2mqv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionNVD
Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is used without validation as the post-login redirect target.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
AnalysisAI
Open redirect in Spring Security's cookie-based saved-request components allows remote unauthenticated attackers to redirect authenticated users to arbitrary external URLs immediately after a successful login. The CookieRequestCache (servlet stack) and CookieServerRequestCache (reactive/WebFlux stack) store the full pre-authentication URL in a browser cookie and use it without origin validation as the post-login Location target, making this exploitable via a socially engineered link. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application uses Spring Security's CookieRequestCache or CookieServerRequestCache for saved-request handling - this is the default behavior in Spring Security form-based login configurations where redirect-after-login is enabled, meaning a broad population of default deployments is affected without additional configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.1 score and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N characterize a remotely exploitable, low-complexity, unauthenticated vulnerability with changed scope and low individual impact ratings. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a phishing email containing a link such as https://trusted-app.example.com/login to a targeted user; if the attacker can influence the redirect cookie (e.g., by crafting a URL that causes the application to set the cookie to https://attacker.com/harvest), the victim browses to the application, successfully completes login, and is immediately and silently redirected to the attacker's credential-harvesting page at the exact moment the user trusts the redirect as part of the normal authentication flow. No public exploit code has been identified at time of analysis, but the attack requires only a browser and knowledge of the application's login URL. |
| Remediation | The primary remediation is to upgrade Spring Security to a patched release per the vendor advisory at https://spring.io/security/cve-2026-41706. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Credential leakage in Erlang/OTP's inets httpc client (versions 17.0 through 29.0.2, 28.5.0.2, and 27.3.4.13) allows att
Open redirect in hs-web hsweb-framework's OAuth2Client component (versions up to 5.0.1) allows remote unauthenticated at
Spring Authorization Server's authorization endpoint fails to adequately validate the OAuth2/OIDC `request_uri` paramete
Host header injection in HCL Digital Experience and HCL Digital Experience Compose enables unauthenticated remote attack
Open redirect in WebOb (pip/webob <= 1.8.9) enables unauthenticated network attackers to redirect victims to arbitrary a
Share
External POC / Exploit Code
Leaving vuln.today