CVE-2026-59355
Received Received - Intake

Open Redirect in Spring Authorization Server

Publication date: 2026-08-27

Last updated on: 2026-08-27

Assigner: VMware

Description
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-27
Last Modified
2026-08-27
Generated
2026-08-27
AI Q&A
2026-08-27
EPSS Evaluated
N/A
NVD
CVE-2026-59355
EUVD
EUVD-2026-66978

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
spring_project spring_authorization_server From 1.5.0 (inc) to 1.5.7 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Spring Authorization Server versions 1.5.0 through 1.5.7. It involves insufficient validation of the request_uri parameter in the authorization endpoint. An attacker can craft a request with an invalid request_uri and an unvalidated redirect_uri, leading to an open redirect to a malicious site.

Detection Guidance

To detect this vulnerability, check if your system is running Spring Authorization Server versions 1.5.0 through 1.5.7. Use commands like 'curl -s http://your-server/actuator/info' or inspect the server logs for version details. Monitor for suspicious authorization requests with invalid request_uri parameters.

Impact Analysis

An attacker could trick users into visiting a malicious site by exploiting this vulnerability. This may lead to phishing attacks, credential theft, or other malicious activities. Users of affected versions are at risk if they interact with the authorization endpoint.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by enabling open redirect attacks. If exploited, it may lead to unauthorized data exposure or phishing attacks, which are critical concerns under these regulations. Open redirects can be used to deceive users into disclosing sensitive information, violating GDPR's data protection principles or HIPAA's safeguards for protected health information.

Mitigation Strategies

Upgrade to Spring Authorization Server version 1.5.8 (OSS) or 1.5.7.1 (Enterprise) to address the vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59355. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart