Compliance Impact

This vulnerability allows an attacker to redirect authenticated users to attacker-controlled URLs immediately after login, enabling phishing attacks.

Such phishing risks can potentially lead to unauthorized disclosure or misuse of personal or sensitive data, which may impact compliance with data protection regulations like GDPR or HIPAA that require safeguarding user data and preventing unauthorized access.

However, the provided information does not explicitly discuss the direct impact on compliance with these standards or regulations.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-41706 is a security vulnerability in Spring Security's CookieRequestCache and CookieServerRequestCache components. These components store the pre-authentication request URL in a browser cookie to redirect users back to their intended destination after login.

In affected versions, the full absolute URL, including scheme, host, and port, is stored in the cookie without validation and used as the post-login redirect target.

An attacker can exploit this vulnerability if they can influence the value of the REDIRECT_URI cookie (for example, through cookie injection, HTTP response splitting, or protocol downgrade attacks) to redirect an authenticated user to an attacker-controlled URL immediately after login, enabling phishing attacks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to redirect authenticated users to malicious websites immediately after login.

Such redirection can be used for phishing attacks, where users might be tricked into providing sensitive information or credentials to attacker-controlled sites.

The attack requires that the attacker can manipulate the REDIRECT_URI cookie, which could be done through techniques like cookie injection via related subdomains, HTTP response splitting, or protocol downgrades.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking if your application uses the CookieRequestCache (Servlet) or CookieServerRequestCache (WebFlux) as its RequestCache implementation and if the REDIRECT_URI cookie can be influenced by an attacker.

You can inspect HTTP traffic to see if the REDIRECT_URI cookie contains full absolute URLs that could be manipulated. Monitoring for unusual or unexpected values in this cookie may indicate exploitation attempts.

Specific commands are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The primary and immediate mitigation step is to upgrade Spring Security to a fixed version that addresses this vulnerability.

• Upgrade to version 5.7.24 if you are using 5.7.0 through 5.7.23.
• Upgrade to version 5.8.26 if you are using 5.8.0 through 5.8.25.
• Upgrade to version 6.3.17 if you are using 6.3.0 through 6.3.16.
• Upgrade to version 6.4.17 if you are using 6.4.0 through 6.4.16.
• Upgrade to version 6.5.11 if you are using 6.5.0 through 6.5.10.
• Upgrade to version 7.0.6 if you are using 7.0.0 through 7.0.5.

No additional mitigation steps are required after upgrading.

Useful 0 Not Useful 0