CVE-2026-59355: Spring Authorization Server: Open Redirect via request_uri parameter
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a request containing an invalid requesturi paired with an unvalidated redirecturi, which can result in an open redirect to an attacker-controlled site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Spring Authorization Serverto a version that resolves this vulnerability.Fixed in 1.5.8 - Upgrade
Upgrade
Spring Authorization Serverto a version that resolves this vulnerability.Fixed in 1.5.7.1
Event History
Frequently Asked Questions
Which deployments are affected?
Spring Authorization Server versions 1.5.0 through 1.5.7 are affected. The issue is in the authorization endpoint's handling of the request_uri parameter.
What does an attacker need to exploit this issue?
An attacker needs to induce a user to interact with a crafted authorization request. The request pairs an invalid request_uri with a redirect_uri that is not validated, causing a redirect to an attacker-controlled site.
What is the practical impact?
Successful exploitation can redirect users from the authorization flow to an attacker-controlled site. The provided severity vector indicates low confidentiality and integrity impact, with user interaction required and no availability impact.