MEDIUM🇵🇱 Wersja polska

CVE-2026-41008

CVSS 6.1v3.1pub. 2026-06-10upd. 2026-07-17

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, which can lead to an Open Redirect vulnerability. Affected versions: Spring Security 7.0.0 through 7.0.5. Spring Authorization Server 1.5.0 through 1.5.7.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

  • Broadcom Spring Authorization Server

    APP
    Broadcom
    1.5.0 – 1.5.7.1 (excl.)

  • VMware Spring Security

    APP
    Vmware
    7.0.0 – 7.0.5.1 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-22732CRITICAL9.1PL ✓same product

VMware Spring Security — brak zapisu nagłówków HTTP odpowiedzi

CVE-2023-34034CRITICAL9.1PL ✓same product

Spring Security WebFlux: ominięcie zabezpieczeń przez wzorzec "**"

CVE-2022-31692CRITICAL9.8PL ✓same product

Spring Security: pominięcie reguł autoryzacji przez forward/include dispatcher

CVE-2022-22978CRITICAL9.8PL ✓same product

Obejście autoryzacji w Spring Security przez RegexRequestMatcher

CVE-2014-3527CRITICAL9.8PL ✓same product

Pominięcie kontroli dostępu w CAS Proxy ticket w Spring Security