CVE-2026-41008: Spring Authorization Server Open Redirect Vulnerability (CVSS 6.1)

Technical summary

The vulnerability stems from insufficient input validation on the request_uri parameter in Spring Security Authorization Server's authorization endpoint. An attacker crafts a malicious authorization request with a malformed request_uri paired with an arbitrary, unvalidated redirect_uri. Due to incomplete validation logic, the server fails to reject the malicious redirect target, leading to CWE-601 (URL Redirection to Untrusted Site). The vulnerability requires user interaction—a victim must click a malicious link or be redirected to the authorization endpoint—and the attack surface is network-accessible without authentication.

Business impact

This vulnerability enables credential harvest and phishing at scale. An attacker can craft a seemingly legitimate authorization link that directs authenticated users to an attacker-controlled site after login, exfiltrating session tokens, credentials, or sensitive data. In environments where Spring Authorization Server acts as a central identity provider, a single instance compromise affects all dependent applications. Organizations relying on OAuth 2.0 delegation for third-party integrations face reputation damage and potential regulatory exposure if user data is intercepted.

Affected systems

Spring Security versions 7.0.0 through 7.0.5 and Spring Authorization Server versions 1.5.0 through 1.5.7 are affected. Any organization deploying these versions as an authorization server or embedded within Spring-based applications is potentially vulnerable. This includes microservices architectures using Spring Boot with OAuth 2.0 authorization delegation, as well as standalone authorization servers providing identity services to multiple tenants or external partners.

Exploitability

Exploitability is straightforward from a technical perspective: an attacker need only craft a malicious URL and distribute it via phishing or social engineering. The attack requires no special privileges, authentication, or complex bypasses. However, the CVSS score of 6.1 reflects that user interaction is necessary—a victim must initiate the authorization flow by clicking the link. This slightly raises the bar compared to pre-authentication server-side exploits, but phishing campaigns and insider attacks make this a practical threat in real-world scenarios.

Remediation

Organizations must immediately upgrade to patched versions provided by Spring and VMware. Verify the specific patch version numbers in the vendor advisories before deployment. Organizations unable to patch immediately should implement network-level controls: restrict authorization endpoint access to trusted networks, enforce HTTPS with certificate pinning for redirect validation, and deploy Web Application Firewalls (WAF) rules to detect malformed request_uri parameters. Additionally, implement strict redirect URI allowlisting at the application configuration level rather than relying on runtime validation alone.

Patch guidance

Contact VMware and Broadcom for patched versions of Spring Security and Spring Authorization Server. Patch versions should be explicitly listed in vendor security advisories; verify against those sources before deployment to production. Test patches in a staging environment to ensure OAuth 2.0 flows remain functional and no legitimate authorization requests are blocked by stricter validation. Prioritize patching for instances exposed to untrusted networks or used as multi-tenant identity providers.

Detection guidance

Monitor authorization endpoint logs for request_uri parameters containing unusual encoding, protocol mismatches, or references to external domains. Implement alerting for redirect_uri values that do not match configured allowlists. Use WAF signatures to detect malformed or suspicious request_uri patterns. Correlate failed authorization attempts with downstream redirects to external IPs. If your environment supports audit logging, review historical authorization requests for signs of exploitation: look for valid credentials paired with unexpected redirect destinations in post-authentication logs.

Why prioritize this

Although the CVSS score is 6.1 (Medium), the practical risk is elevated due to ease of exploitation, phishing compatibility, and high-value attack targets. Organizations with externally accessible authorization servers or those providing identity services to partners should treat this as a near-critical priority. The attack chain is simple, and the attacker gains access to sessions or credentials—both high-value outcomes. Internal-only authorization servers have somewhat lower urgency but should not be deprioritized indefinitely.

Risk score, explained

CVSS 3.1 score of 6.1 reflects: Network-accessible attack vector (AV:N), Low attack complexity (AC:L), no authentication required (PR:N), but User Interaction required (UI:R). The impact is Confidentiality and Integrity degradation (C:L/I:L) with no Availability impact (A:N). The Scope Change (S:C) accounts for potential impact on downstream systems. The Medium severity designation acknowledges that real-world exploitation depends on social engineering and victim action, but the ease of crafting attacks and the sensitive nature of OAuth flows warrant careful monitoring and timely patching.

Frequently asked questions