CVE-2026-47887: Spring Framework Open Redirect Vulnerability

CVE-2026-47887 Overview

CVE-2026-47887 is an open redirect vulnerability affecting Spring MVC applications that use UrlFilenameViewController. The flaw exists when the controller is mapped with an end-of-path pattern and has no configured prefix. Attackers can craft URLs that cause the application to redirect users to attacker-controlled destinations.

Open redirect flaws enable phishing campaigns, credential theft, and OAuth token interception. Because the redirect originates from a trusted domain, victims and security controls are more likely to trust the destination.

Critical Impact
Vulnerable Spring MVC endpoints can be abused to redirect authenticated users to attacker-controlled sites, enabling phishing and credential theft against trusted domains.

Affected Products

Spring Framework 7.0.0 through 7.0.8
Spring Framework 6.2.0 through 6.2.19, 6.1.0 through 6.1.28, 6.0.0 through 6.0.30
Spring Framework 5.3.0 through 5.3.49 and 5.2.25.RELEASE and earlier

Discovery Timeline

2026-08-27 - CVE-2026-47887 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47887

Vulnerability Analysis

The vulnerability affects UrlFilenameViewController, a Spring MVC controller that derives view names from the request URL. When the controller is mapped using an end-of-path pattern such as /** and no view name prefix is configured, the resolved view name is influenced directly by attacker-controlled path segments.

Spring's view resolution logic can interpret certain path values as absolute URLs or protocol-relative references. When such a value is passed to a view that performs a redirect, the framework issues an HTTP 302 response pointing to the untrusted destination. The result is a classic open redirect [CWE-601] where the response Location header carries an external URL.

Root Cause

The root cause is insufficient validation of view names derived from request paths inside UrlFilenameViewController. Without a configured prefix, the controller does not constrain the resolved view to an internal template, allowing external URL patterns to flow through view resolution and produce redirects.

Attack Vector

An attacker constructs a URL against a vulnerable endpoint that appends a specially crafted path segment interpreted as an external URL. The attacker distributes this link through email, chat, or social platforms. Victims who click the link are redirected from the trusted application to the attacker's site, which typically hosts a credential-harvesting page or a malicious OAuth callback.

See the Spring Security advisory for CVE-2026-47887 for authoritative technical details and affected version ranges.

Detection Methods for CVE-2026-47887

Indicators of Compromise

HTTP 302 responses from Spring MVC endpoints where the Location header points to external, unexpected domains.
Access log entries containing suspicious path segments with embedded schemes such as http:, https:, or //attacker.tld.
Increased outbound clicks from application URLs to unfamiliar third-party domains in web proxy logs.

Detection Strategies

Inventory Spring MVC configurations for UrlFilenameViewController beans and identify any mapped with /** or similar end-of-path patterns without a configured prefix.
Deploy web application firewall (WAF) rules that flag request paths containing URL-like substrings targeting Spring endpoints.
Perform static analysis of application configuration to detect view controllers lacking explicit view name prefixes.

Monitoring Recommendations

Monitor reverse proxy and application logs for anomalous 3xx redirects originating from Spring endpoints.
Correlate outbound redirect destinations with threat intelligence feeds of known phishing and malware domains.
Alert when redirect destinations do not match an allowlist of approved internal or partner domains.

How to Mitigate CVE-2026-47887

Immediate Actions Required

Upgrade Spring Framework to a patched release: 7.0.9 or later, 6.2.20 or later, 6.1.29 or later, or 6.0.31 or later depending on your branch.
For 5.3.x deployments, apply the vendor-supplied maintenance release; note that 5.2.x and earlier are end-of-life and require commercial support or migration.
Audit all uses of UrlFilenameViewController and remove or restrict end-of-path mappings that lack a view name prefix.

Patch Information

Review the Spring Security advisory for CVE-2026-47887 for the authoritative list of fixed versions and upgrade guidance. Apply patches to all affected Spring Framework instances across development, staging, and production environments.

Workarounds

Configure an explicit view name prefix on UrlFilenameViewController so resolved view names cannot escape internal templates.
Replace end-of-path mappings such as /** with narrower path patterns that limit what request segments reach the controller.
Add a WAF or reverse proxy rule to reject request paths containing URL schemes or protocol-relative prefixes targeting the affected endpoints.

bash

# Configuration example: constrain view resolution with an explicit prefix
# Ensures resolved view names cannot represent external URLs
# (Java configuration excerpt)
#
# @Bean
# public UrlFilenameViewController urlFilenameViewController() {
#     UrlFilenameViewController controller = new UrlFilenameViewController();
#     controller.setPrefix("internal/");
#     controller.setSuffix(".jsp");
#     return controller;
# }