CVE-2026-41008: Spring Security Authorization Server Open Redirect via request_uri
Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can lead to an Open Redirect vulnerability.
Affected versions: Spring Security 7.0.0 through 7.0.5. Spring Authorization Server 1.5.0 through 1.5.7.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41008?
CVE-2026-41008 has a medium severity rating of 6.1.
How do I fix CVE-2026-41008?
To fix CVE-2026-41008, ensure that your Spring Security Authorization Server is updated to the latest version that addresses the request_uri validation.
What type of vulnerability is CVE-2026-41008?
CVE-2026-41008 is classified as an Open Redirect vulnerability.
What impact can CVE-2026-41008 have on my application?
CVE-2026-41008 can lead to attackers redirecting users to malicious sites if the request_uri is not properly validated.
Which software is affected by CVE-2026-41008?
CVE-2026-41008 affects the Spring Security and Spring Authorization Server components.