Open redirect in Spring Authorization Server and Spring Security - CVE-2026-41008
Published: August 28, 2026
Vulnerability identifier: #VU146182
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41008
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redirect users to an arbitrary URL.
The vulnerability exists due to improper input validation in the authorization endpoint when processing authorization requests containing a request_uri parameter. A remote attacker can send a crafted authorization request with an invalid request_uri and an unvalidated redirect_uri to redirect users to an arbitrary URL.
User interaction is required to follow the crafted authorization flow.
Affected software
Spring Authorization Server
Spring Security
Spring Security
How to mitigate CVE-2026-41008
Install security update from vendor's website.
Spring Authorization Server - update to 1.5.8
Spring Security - update to 7.0.6
Spring Security - update to 7.0.6