CVE-2026-59355: Spring Authorization Server Open Redirect

CVE-2026-59355 Overview

CVE-2026-59355 affects Spring Authorization Server versions 1.5.0 through 1.5.7. The authorization endpoint performs insufficient validation of the request_uri parameter. Attackers can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, producing an open redirect [CWE-601] to an attacker-controlled site. The flaw requires user interaction and impacts confidentiality and integrity at a limited scope, but changes security scope by leveraging the trusted authorization server domain for phishing and token theft campaigns.

Critical Impact
Attackers can weaponize the trusted authorization server URL to redirect victims to malicious sites, enabling credential phishing and OAuth token interception.

Affected Products

Spring Authorization Server 1.5.0
Spring Authorization Server 1.5.1 through 1.5.6
Spring Authorization Server 1.5.7

Discovery Timeline

2026-08-27 - CVE-2026-59355 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-59355

Vulnerability Analysis

Spring Authorization Server implements the OAuth 2.1 and OpenID Connect 1.0 authorization endpoint. The endpoint accepts a request_uri parameter under the Pushed Authorization Requests (PAR) and JAR extensions. In affected versions, the server does not properly validate this parameter before falling back to processing accompanying request parameters, including redirect_uri.

When the request_uri is malformed or references an unknown resource, the server continues processing the request instead of rejecting it outright. The redirect_uri value is then used in the response flow without confirming it matches a registered client redirect URI. This chained failure produces an open redirect from a trusted OAuth authorization endpoint.

The vulnerability enables phishing that abuses the authorization server's domain reputation. Victims see a legitimate authorization server URL in the initial request, then land on an attacker-controlled site.

Root Cause

The root cause is insufficient input validation on the request_uri parameter combined with missing redirect URI allow-list enforcement in the fallback code path. The authorization endpoint should reject any request with an invalid request_uri before evaluating dependent parameters, and it must strictly match redirect_uri against the client's registered values.

Attack Vector

The attack requires network access to the authorization endpoint and user interaction. An attacker constructs a URL pointing to the vulnerable Spring Authorization Server that includes an invalid request_uri value together with a redirect_uri under attacker control. The attacker delivers the crafted URL via email, chat, or a compromised web page. When the victim clicks the link, the server processes the request and redirects the browser to the attacker-controlled destination, where credential harvesting or malicious content delivery occurs.

No authentication is required to craft the malicious URL, and the redirect originates from a domain the victim trusts. See the Spring Security advisory for CVE-2026-59355 for vendor-confirmed details.

Detection Methods for CVE-2026-59355

Indicators of Compromise

Authorization endpoint access logs containing request_uri parameters that do not correspond to any pushed authorization request or registered JAR reference.
HTTP 302 responses from /oauth2/authorize with Location headers pointing to domains outside the client's registered redirect_uri allow-list.
Spikes in authorization requests from a single referrer that include external redirect_uri values.

Detection Strategies

Parse authorization server access logs and flag requests containing both a request_uri parameter and a redirect_uri parameter, which is an unusual combination for standards-compliant clients.
Correlate outbound redirects from the authorization endpoint against the registered client redirect URI allow-list and alert on mismatches.
Monitor for phishing infrastructure by extracting redirect target hostnames from authorization endpoint logs and cross-referencing threat intelligence feeds.

Monitoring Recommendations

Enable verbose logging on the Spring Authorization Server authorization endpoint to capture all query parameters and response Location headers.
Forward authorization server logs to a centralized SIEM for real-time analysis of redirect anomalies.
Track user reports of unexpected redirects following OAuth login flows and investigate promptly.

How to Mitigate CVE-2026-59355

Immediate Actions Required

Upgrade Spring Authorization Server to a patched release above 1.5.7 as identified in the Spring Security advisory.
Audit registered OAuth clients and remove any wildcard or overly permissive redirect_uri entries.
Review authorization endpoint logs for prior exploitation attempts using invalid request_uri values.

Patch Information

Pivotal has published the fix in the Spring Security advisory for CVE-2026-59355. Consult the advisory for the specific fixed version and upgrade path applicable to your deployment.

Workarounds

Deploy a reverse proxy or web application firewall rule that rejects requests to /oauth2/authorize containing both request_uri and external redirect_uri parameters.
Enforce strict exact-match validation of redirect_uri against the client registration at the proxy layer until the upgrade completes.
Disable Pushed Authorization Requests and JAR support if these OAuth extensions are not required by your clients.

bash

# Example WAF rule pattern to block suspicious combinations
# Reject authorize requests carrying both request_uri and an off-domain redirect_uri
SecRule REQUEST_URI "@beginsWith /oauth2/authorize" \
  "chain,deny,status:400,id:1059355,msg:'CVE-2026-59355 open redirect attempt'"
  SecRule ARGS:request_uri ".+" "chain"
    SecRule ARGS:redirect_uri "!@rx ^https://([a-z0-9.-]+\.)?trusted-client\.example\.com/"