EUVD-2026-35896
GHSA-x2r2-rvhq-2mqv
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (vmware) · only source for this CVE.
CVSS VectorVendor: vmware
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
2Blast Radius
ecosystem impact- 181 maven packages depend on org.springframework.security:spring-security-web (25 direct, 156 indirect)
Ecosystem-wide dependent count for version 7.0.0.
DescriptionCVE.org
Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is used without validation as the post-login redirect target.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
AnalysisAI
Open redirect in Spring Security's cookie-based saved-request components allows remote unauthenticated attackers to redirect authenticated users to arbitrary external URLs immediately after a successful login. The CookieRequestCache (servlet stack) and CookieServerRequestCache (reactive/WebFlux stack) store the full pre-authentication URL in a browser cookie and use it without origin validation as the post-login Location target, making this exploitable via a socially engineered link. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the S:C scope change and PR:N attack profile make this a meaningful phishing enabler in any Spring Security deployment using cookie-backed saved requests.
Technical ContextAI
Spring Security is the de facto Java security framework for Spring and Spring Boot applications, handling authentication, authorization, and session management. The CookieRequestCache (used in the servlet/MVC stack) and CookieServerRequestCache (used in the reactive/WebFlux stack) implement a UX pattern where the pre-authentication destination URL is persisted in a browser cookie so users are transparently redirected to their intended page after logging in. The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect): the stored URL value is read back from the cookie and used directly in the HTTP Location response header without validating that the URL belongs to the same origin or is on a permitted allowlist. An attacker who can deliver a crafted URL to a victim - one that sets or influences the redirect cookie value to point to an external site - can hijack the post-login redirect. Both the synchronous MVC and asynchronous reactive stacks are affected, broadening the exposure across the full range of Spring web application deployment models.
RemediationAI
The primary remediation is to upgrade Spring Security to a patched release per the vendor advisory at https://spring.io/security/cve-2026-41706. Exact fixed version numbers for each affected branch (5.7.x, 5.8.x, 6.3.x, 6.4.x, 6.5.x, 7.0.x) were not confirmed in the provided data and must be verified directly against the advisory before applying. If immediate patching is not feasible, a compensating control is to implement a custom SavedRequestAwareAuthenticationSuccessHandler (servlet) or custom ServerRedirectStrategy (reactive) that validates the redirect URL against an explicit allowlist of permitted origins before issuing the Location response - rejecting or defaulting to '/' any URL whose host does not match the application's own domain. This mitigation requires application code changes but fully eliminates the redirect vector. A secondary layer is WAF-based inspection of Set-Cookie headers on login responses to flag or strip cookie values containing external URLs, though this is operationally fragile and should not substitute for the code-level fix. Note that switching from CookieRequestCache to HttpSessionRequestCache avoids this specific class of cookie-based attack surface but introduces server-side session state requirements, which may have scalability trade-offs in stateless deployments.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today