CVE-2026-41008: VMware Spring Security Authorization Server open redirect in authorization endpoint

CVE-2026-41008 · Severity: medium · CVSS 6.1 · Published 2026-06-10

Spring Security and Spring Authorization Server, which provide authentication and authorization services for Java applications, are vulnerable to an open redirect flaw. An attacker can craft a malicious link that appears to be a legitimate login request but instead redirects the user to an untrusted, potentially malicious website after they interact with the authorization endpoint. This can be used in phishing campaigns to steal user credentials or distribute malware by tricking users into trusting the destination URL.

Technologies: VMware Spring Authorization Server, VMware Spring Security. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-41008 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41008 being exploited in the wild.
How severe is CVE-2026-41008?
Medium severity, with a CVSS score of 6.1, published 10 June 2026.
Which products and versions are affected?
org.springframework.security:spring-security-oauth2-authorization-server (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.6; VMware Spring Authorization Server 1.5.0 through 1.5.7; VMware Spring Security 7.0.0 through 7.0.5.
Is there a fix for CVE-2026-41008?
Yes. org.springframework.security:spring-security-oauth2-authorization-server (Maven): upgrade to 7.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41008 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41008?
Check whether you run org.springframework.security:spring-security-oauth2-authorization-server (Maven), VMware Spring Authorization Server or VMware Spring Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.springframework.security:spring-security-oauth2-authorization-server (Maven): upgrade to 7.0.6 or later
    # set org.springframework.security:spring-security-oauth2-authorization-server to 7.0.6 in your pom.xml or build.gradle

Technical details

An open redirect vulnerability (CWE-601) exists in the Spring Security Authorization Server's authorization endpoint. The root cause is insufficient validation of the 'request_uri' parameter. An unauthenticated remote attacker can craft a malicious authorization request containing an invalid 'request_uri' alongside an arbitrary, unvalidated 'redirect_uri'. If a user interacts with this request, the server may redirect them to the attacker-controlled URL. This issue is addressed in Spring Security 7.0.6 (and 7.0.5.1) and Spring Authorization Server 1.5.8 (and 1.5.7.1).

Affected products

  • Spring Spring Security 7.0.0 through 7.0.5.1
  • Spring Spring Authorization Server 1.5.0 through 1.5.7.1

Identifiers

  • CVE-2026-41008
  • GHSA-4r8w-73jc-3m7q

Timeline

  • 2026-06-09: disclosed
  • 2026-06-10: advisory
  • 2026-06-10: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.