CVE-2026-11477: hsweb-framework Open Redirect Vulnerability

CVE-2026-11477 Overview

CVE-2026-11477 is an open redirect vulnerability [CWE-601] in the hs-web hsweb-framework through version 5.0.1. The flaw resides in the OAuth2Client function defined in hsweb-authorization/hsweb-authorization-oauth2/src/main/java/org/hswebframework/web/oauth2/server/OAuth2Client.java. Attackers can manipulate the redirect_uri parameter to bypass validation in the OAuth2 client component. The exploit is publicly available, and remote attackers can trigger it without authentication, though user interaction is required. The maintainers released a fix in commit c2882679a9125cea52678151af5ae213cbd52579, which introduces a configurable strict validation mode.

Critical Impact
Attackers can craft malicious OAuth2 authorization links that redirect victims to attacker-controlled domains after authentication, enabling phishing and token theft against users of applications built on hsweb-framework.

Affected Products

hs-web hsweb-framework versions up to and including 5.0.1
Applications using the hsweb-authorization-oauth2 module
OAuth2 client deployments relying on the default COMPATIBLE redirect URI validation mode

Discovery Timeline

2026-06-08 - CVE-2026-11477 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11477

Vulnerability Analysis

The vulnerability is an open redirect [CWE-601] in the OAuth2 authorization server logic of hsweb-framework. The OAuth2Client component performs insufficient validation when comparing the client-supplied redirect_uri parameter against registered URIs. An attacker can craft a redirect_uri value that satisfies the lenient comparison while pointing to an external domain under attacker control. Because the redirect occurs after a legitimate authorization flow, victims see a trusted login origin before being sent to the malicious destination.

Root Cause

The root cause is the absence of strict, exact-match validation for the redirect_uri parameter. The pre-patch code allowed a permissive comparison that accepted URIs containing or appended with the registered value, rather than requiring full equality. This is a classic OAuth2 implementation weakness where loose URI matching enables redirector abuse.

Attack Vector

Exploitation is remote and network-based. An attacker constructs an OAuth2 authorization request to a vulnerable hsweb-framework endpoint, supplying a manipulated redirect_uri. The victim clicks the crafted link, authenticates legitimately, and is then redirected to an attacker-controlled URL. The destination can harvest authorization codes, access tokens passed via URL fragments, or stage credential phishing on a familiar-looking page.

java

// Patch excerpt from OAuth2Properties.java introducing strict validation mode
//refreshToken有效期
private Duration refreshTokenIn = Duration.ofDays(30);

//redirect_uri 校验模式
private RedirectUriValidationMode redirectUriValidationMode = RedirectUriValidationMode.COMPATIBLE;

public enum RedirectUriValidationMode {
    COMPATIBLE,
    EXACT
}

Source: GitHub Commit c2882679

The patch also wires the new properties into the controller bean:

java

@ConditionalOnMissingBean
@ConditionalOnBean(OAuth2ClientManager.class)
public OAuth2AuthorizeController oAuth2AuthorizeController(OAuth2GrantService grantService,
                                                           OAuth2ClientManager clientManager,
                                                           OAuth2Properties properties) {
    return new OAuth2AuthorizeController(grantService, clientManager, properties);
}

Source: GitHub Commit c2882679

Detection Methods for CVE-2026-11477

Indicators of Compromise

OAuth2 authorization requests containing redirect_uri values that resolve to domains outside the registered client allowlist.
Access logs showing /oauth2/authorize requests with redirect_uri parameters using URL-encoded characters, subdomain tricks, or appended path components.
Outbound HTTP 302 responses from hsweb-framework endpoints sending users to unfamiliar external hosts.

Detection Strategies

Parse web server and application logs for redirect_uri parameter values, then compare against the configured client registration list for exact matches.
Alert on OAuth2 flows where the post-authorization redirect destination does not match any registered client URI in the OAuth2ClientManager configuration.
Inspect HTTP referrer chains for sessions where authenticated users transition from the OAuth2 endpoint to non-corporate domains.

Monitoring Recommendations

Enable verbose logging on the hsweb-authorization-oauth2 module to capture every redirect_uri value submitted during authorization.
Monitor for spikes in OAuth2 authorization requests from a single source IP or against a single client ID, which may indicate phishing campaign reconnaissance.
Track user reports of suspicious post-login redirects and correlate timestamps with authorization endpoint activity.

How to Mitigate CVE-2026-11477

Immediate Actions Required

Upgrade hsweb-framework to the version that includes commit c2882679a9125cea52678151af5ae213cbd52579.
After upgrading, set redirectUriValidationMode to EXACT to enforce strict redirect URI matching.
Audit all registered OAuth2 clients and remove unused or wildcard-style redirect URI entries.
Notify users of phishing risk and reinforce awareness that OAuth2 consent screens may precede malicious redirects.

Patch Information

The fix is delivered in commit c2882679a9125cea52678151af5ae213cbd52579, merged via Pull Request #355 and tracked in Issue #354. The patch adds an OAuth2Properties.RedirectUriValidationMode enum with COMPATIBLE and EXACT options, allowing operators to enforce strict equality checks on the redirect_uri parameter. Additional context is available in the VulDB CVE Report.

Workarounds

If immediate upgrade is not feasible, place a reverse proxy or web application firewall in front of the OAuth2 endpoint and reject requests whose redirect_uri parameter does not match an allowlist.
Restrict the set of registered client redirect URIs to a minimal, fully-qualified list with no wildcard hosts or paths.
Disable any OAuth2 clients that are not actively in use until the patch is applied.

bash

# Configuration example - enforce strict redirect_uri matching after upgrade
# application.yml
hsweb:
  oauth2:
    server:
      redirect-uri-validation-mode: EXACT
      access-token-in: PT2H
      refresh-token-in: P30D