Executive brief
hsweb-framework is a Java-based development framework. A security flaw in its OAuth2 component allows attackers to redirect users to malicious websites during the login process. This could be used in phishing attacks to steal sensitive authorization codes or credentials by tricking users into visiting a site that appears legitimate but is controlled by an attacker.
Technical details
An open redirect vulnerability exists in hsweb-framework up to version 5.0.1 within the OAuth2Client.java component. The root cause is the use of simple string prefix matching (startsWith) to validate the 'redirect_uri' parameter. An attacker can bypass this check by crafting a URL that includes a trusted domain as the 'userinfo' portion of the URI (e.g., https://trusted.com:password@evil.com), which satisfies the prefix check but resolves to an attacker-controlled host. This allows for the theft of OAuth2 authorization codes. The issue is addressed in commit c2882679a9125cea52678151af5ae213cbd52579 by implementing proper URI component validation.
Affected products
- hs-web hsweb-framework <= 5.0.1
Timeline
- 2026-05-19: patched: Fix merged in pull request 355
- 2026-06-08: disclosed: CVE published to NVD and GitHub Advisory Database