CVE-2026-59355
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
In Spring Authorization Server versions 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request with an invalid request_uri and an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.
Risk Assessment
Open redirect can be used for phishing, token theft, or bypassing security mechanisms, threatening users and the integrity of the login process.
Recommendation
Update Spring Authorization Server to a patched version and configure redirect_uri and request_uri validation as recommended by the vendor.
Other vulnerabilities in Spring Authorization Server
See all- CVE-2026-22752Critical
An authentication bypass vulnerability due to a primary weakness in Spring Authorization Server. Affects versions from 7.0.0 to 7.0.4, from 1.5.0 to 1.5.6, from 1.4.0 to 1.4.9, and from 1.3.0 to 1.3.10.
- CVE-2026-59316High
Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. An attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the default consent page. Affected versions are 1.5.0-1.5.8 and 1.4.0-1.4.11.
Original NVD description (English source)
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.