Executive Summary

The vulnerability CVE-2026-11477 exists in the OAuth2 implementation of the hsweb-framework, specifically in the OAuth2Client component. It involves a flaw in the validation of the redirect_uri parameter during the OAuth2 authorization process.

The framework originally used a simple prefix-based check to validate redirect URIs, which could be bypassed by manipulating parts of the URL such as the userinfo component. This bypass allows an attacker to redirect the OAuth2 flow to an unintended destination, resulting in an open redirect vulnerability.

The vulnerability can be exploited remotely and the exploit is publicly known. The issue was fixed by replacing the prefix-based validation with stricter URI component checks, introducing configurable validation modes (COMPATIBLE and EXACT), rejecting redirect URIs containing fragments, and binding authorization codes to the authorized redirect URI to prevent misuse.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to perform open redirect attacks during the OAuth2 authorization process.

An attacker could manipulate the redirect_uri parameter to redirect users to malicious sites, potentially leading to phishing attacks or unauthorized access.

Because the OAuth2 flow is critical for authentication and authorization, exploiting this vulnerability could undermine the security of applications relying on the hsweb-framework for OAuth2, potentially compromising user sessions or credentials.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability involves bypassing the redirect_uri validation in the OAuth2 implementation of hsweb-framework by manipulating the redirect_uri parameter, especially via URL userinfo or fragments.

To detect this vulnerability on your system, you can monitor OAuth2 authorization requests for suspicious redirect_uri parameters that include unusual userinfo components or fragments that could bypass prefix-based validation.

Commands to detect such attempts might include capturing and inspecting HTTP requests to the OAuth2 authorization endpoint, for example using tools like tcpdump or Wireshark to filter for requests containing redirect_uri parameters.

• Use tcpdump to capture HTTP traffic on port 80 or 443: tcpdump -i any -A 'tcp port 80 or tcp port 443' | grep redirect_uri
• Use curl or similar tools to test redirect_uri parameters with userinfo or fragments to see if the system improperly accepts them.
• Review application logs for OAuth2 authorization requests containing redirect_uri values with embedded userinfo or fragments.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to apply the patch identified as c2882679a9125cea52678151af5ae213cbd52579, which fixes the redirect_uri validation logic in the OAuth2Client component.

This patch replaces the insecure prefix-based validation with stricter URI parsing and comparison, including rejecting redirect URIs containing fragments and binding authorization codes to the authorized redirect_uri.

Additionally, configure the new option hsweb.oauth2.redirect-uri-validation-mode to enforce stricter validation modes (COMPATIBLE or EXACT) as appropriate for your environment.

Until the patch is applied, consider monitoring and blocking OAuth2 authorization requests with suspicious redirect_uri parameters that could exploit this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in the OAuth2 redirect_uri validation of the hsweb-framework allows an attacker to perform an open redirect by bypassing the redirect_uri validation. This could potentially enable phishing attacks or unauthorized redirection of OAuth2 authorization flows.

Such security weaknesses in OAuth2 implementations can impact compliance with standards and regulations like GDPR and HIPAA, which require protection of user data and secure authentication mechanisms to prevent unauthorized access and data breaches.

By allowing open redirects, the vulnerability could facilitate attacks that compromise user data confidentiality and integrity, thus potentially violating regulatory requirements for secure handling of personal and sensitive information.

Applying the provided patch that enforces stricter redirect_uri validation and binds authorization codes to authorized redirect URIs helps mitigate these risks and supports compliance with such standards.

Useful 0 Not Useful 0