Executive brief
Spring Security is a widely used framework for securing Java-based web applications. A vulnerability in its login redirection mechanism allows attackers to trick users into visiting malicious websites after they successfully log in. This could be used in phishing campaigns to steal user credentials or distribute malware by making a fraudulent site appear to be a legitimate part of the application's login process.
Technical details
An open redirect vulnerability exists in Spring Security's CookieRequestCache and CookieServerRequestCache components. These components store the full absolute URL of a pre-authentication request in a browser cookie to redirect the user back to their original destination after a successful login. Because the stored URL is used as the redirect target without proper validation, a remote attacker can craft a link that, upon successful authentication, redirects the victim to an arbitrary external domain. This is classified as CWE-601. The issue is addressed in Spring Security versions 6.5.11 and 7.0.6.
Affected products
- Spring Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-06-09: patched: Release 6.5.11 tagged on GitHub