CVE-2026-41008: Spring Security Open Redirect Vulnerability

CVE-2026-41008 Overview

CVE-2026-41008 is an Open Redirect vulnerability [CWE-601] affecting the Spring Security Authorization Server's authorization endpoint. The endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request that combines an invalid request_uri with an arbitrary, unvalidated redirect_uri. The flawed validation path allows the server to honor the attacker-supplied redirect target, sending victims to attacker-controlled destinations.

The issue affects Spring Security versions 7.0.0 through 7.0.5 and Spring Authorization Server versions 1.5.0 through 1.5.7. Exploitation requires user interaction, typically by tricking a user into clicking a crafted link.

Critical Impact
Attackers can redirect authenticated users to attacker-controlled domains, enabling phishing, credential theft, and OAuth flow abuse against applications that rely on Spring Authorization Server.

Affected Products

Spring Security 7.0.0 through 7.0.5
Spring Authorization Server 1.5.0 through 1.5.7
Applications embedding the affected authorization endpoint

Discovery Timeline

2026-06-10 - CVE-2026-41008 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-41008

Vulnerability Analysis

The Spring Authorization Server implements the OAuth 2.0 Pushed Authorization Requests (PAR) extension, which lets clients reference a pre-registered authorization payload through the request_uri parameter. The authorization endpoint accepts this parameter alongside standard OAuth fields including redirect_uri.

The vulnerability stems from the endpoint accepting an invalid request_uri value without rejecting the surrounding request. When validation of request_uri fails, the server continues to process other query parameters and honors an unvalidated redirect_uri. The result is a classic Open Redirect [CWE-601] reachable through the authorization flow.

User interaction is required, as the victim must follow the attacker-crafted authorization URL. The redirect occurs in a security-sensitive context, which increases the credibility of follow-on phishing pages and may be chained with token interception in misconfigured OAuth clients.

Root Cause

The authorization endpoint does not abort the request when request_uri is invalid. Parameter validation is decoupled from redirect target validation, so the unvalidated redirect_uri is used as the response location instead of being rejected against the client's registered redirect URIs.

Attack Vector

The attack is network-reachable and unauthenticated but requires user interaction. An attacker builds an authorization URL pointing at a vulnerable Spring Authorization Server, supplies a malformed request_uri, and sets redirect_uri to a domain they control. When the victim clicks the link, the authorization endpoint forwards them to the attacker's site. The crafted URL retains the legitimate server's hostname, which raises the success rate of phishing pages presented after the redirect. See the Spring Security Advisory for the full advisory text.

Detection Methods for CVE-2026-41008

Indicators of Compromise

Authorization endpoint requests that include both a request_uri parameter and a redirect_uri parameter pointing to an external domain not in the client's registered redirect URIs.
HTTP 302 responses from /oauth2/authorize (or the configured authorization endpoint) with Location headers pointing to unregistered hosts.
Spikes in authorization requests carrying malformed or unknown request_uri values.

Detection Strategies

Parse access logs for the authorization endpoint and flag requests where the redirect_uri host does not match any registered client redirect host.
Correlate request_uri validation failures with subsequent redirect responses in the same request to identify exploitation attempts.
Inspect referrer chains from internal applications to detect users arriving via the authorization endpoint with external redirect destinations.

Monitoring Recommendations

Enable verbose logging on the Spring Authorization Server for OAuth parameter validation outcomes.
Forward authorization endpoint logs to a SIEM and alert on redirect_uri values outside an allowlist of registered client domains.
Track the running version of spring-security and spring-authorization-server across services and alert on versions in the vulnerable range.

How to Mitigate CVE-2026-41008

Immediate Actions Required

Upgrade Spring Security past 7.0.5 and Spring Authorization Server past 1.5.7 to the fixed releases identified in the Spring Security Advisory.
Audit registered OAuth clients and remove wildcard or overly permissive redirect_uri entries.
Review authorization endpoint logs for prior requests carrying invalid request_uri values combined with external redirect_uri targets.

Patch Information

VMware/Spring has published fixed versions for both affected components. Refer to the Spring Security Advisory for the exact patched versions and release notes. Apply the upgrade through your dependency manager and redeploy all services that embed the authorization endpoint.

Workarounds

Deploy a reverse proxy or WAF rule that rejects authorization requests where redirect_uri does not match the registered client allowlist.
Strip or reject requests containing a request_uri parameter if your deployment does not use the OAuth 2.0 Pushed Authorization Requests extension.
Enforce strict exact-match validation of redirect_uri in the client configuration rather than prefix or pattern matching.

bash

# Example Maven dependency update to a fixed release
# Replace <FIXED_VERSION> with the patched version from the Spring advisory
mvn versions:set-property -Dproperty=spring-security.version -DnewVersion=<FIXED_VERSION>
mvn versions:set-property -Dproperty=spring-authorization-server.version -DnewVersion=<FIXED_VERSION>
mvn -U clean verify