Executive brief
Spring Security and Spring Authorization Server, which provide authentication and authorization services for Java applications, are vulnerable to an open redirect flaw. An attacker can craft a malicious link that appears to be a legitimate login request but instead redirects the user to an untrusted, potentially malicious website after they interact with the authorization endpoint. This can be used in phishing campaigns to steal user credentials or distribute malware by tricking users into trusting the destination URL.
Technical details
An open redirect vulnerability (CWE-601) exists in the Spring Security Authorization Server's authorization endpoint. The root cause is insufficient validation of the 'request_uri' parameter. An unauthenticated remote attacker can craft a malicious authorization request containing an invalid 'request_uri' alongside an arbitrary, unvalidated 'redirect_uri'. If a user interacts with this request, the server may redirect them to the attacker-controlled URL. This issue is addressed in Spring Security 7.0.6 (and 7.0.5.1) and Spring Authorization Server 1.5.8 (and 1.5.7.1).
Affected products
- Spring Spring Security 7.0.0 through 7.0.5.1
- Spring Spring Authorization Server 1.5.0 through 1.5.7.1
Timeline
- 2026-06-09: disclosed
- 2026-06-10: advisory
- 2026-06-10: patched