# CVE-2026-41706: VMware Spring Security open redirect in CookieRequestCache

Source: https://junglewise.ai/threats/cve-2026-41706-vmware-spring-security-open-redirect-in-cookierequestcache  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-08-12  
License: CC BY 4.0 with a link back

CVE-2026-41706 · Severity: medium · CVSS 6.1 · Published 2026-06-10

Spring Security is a widely used framework for securing Java-based web applications. A vulnerability in its login redirection mechanism allows attackers to trick users into visiting malicious websites after they successfully log in. This could be used in phishing campaigns to steal user credentials or distribute malware by making a fraudulent site appear to be a legitimate part of the application's login process.

Technologies: [org.springframework.security:spring-security-web (Maven)](https://junglewise.ai/threats/technologies/org-springframework-security-spring-security-web), [VMware Spring Security](https://junglewise.ai/threats/technologies/spring-security). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-41706 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41706 being exploited in the wild.

**How severe is CVE-2026-41706?** Medium severity, with a CVSS score of 6.1, published 10 June 2026.

**Which products and versions are affected?** org.springframework.security:spring-security-web (Maven) ECOSYSTEM:introduced=7.0.0,fixed=7.0.6; VMware Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

**Is there a fix for CVE-2026-41706?** Yes. org.springframework.security:spring-security-web (Maven): upgrade to 7.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41706 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41706?** Check whether you run org.springframework.security:spring-security-web (Maven) or VMware Spring Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.security:spring-security-web (Maven): upgrade to 7.0.6 or later

  ```sh
  # set org.springframework.security:spring-security-web to 7.0.6 in your pom.xml or build.gradle
  ```


## Technical details

An open redirect vulnerability exists in Spring Security's CookieRequestCache and CookieServerRequestCache components. These components store the full absolute URL of a pre-authentication request in a browser cookie to redirect the user back to their original destination after a successful login. Because the stored URL is used as the redirect target without proper validation, a remote attacker can craft a link that, upon successful authentication, redirects the victim to an arbitrary external domain. This is classified as CWE-601. The issue is addressed in Spring Security versions 6.5.11 and 7.0.6.

## Affected products

- Spring Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5

## Identifiers

- CVE-2026-41706
- GHSA-x2r2-rvhq-2mqv

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory
- 2026-06-09: patched: Release 6.5.11 tagged on GitHub

## References

- [https://spring.io/security/cve-2026-41706](https://spring.io/security/cve-2026-41706)
- [https://github.com/spring-projects/spring-security/releases/tag/6.5.11](https://github.com/spring-projects/spring-security/releases/tag/6.5.11)
- [https://github.com/spring-projects/spring-security/releases/tag/7.0.6](https://github.com/spring-projects/spring-security/releases/tag/7.0.6)

## Related threats

- [Spring Security InetAddressMatchers IP classification bypass](https://junglewise.ai/threats/cve-2026-59277-spring-security-inetaddressmatchers-ip-classification-bypass)
- [Spring Security timing attack on security-sensitive string comparison](https://junglewise.ai/threats/cve-2026-59276-spring-security-timing-attack-on-security-sensitive-string)
- [Spring Security OAuth2 Authorization Server metadata validation in Dynamic Client Registration](https://junglewise.ai/threats/cve-2026-59354-spring-security-oauth2-authorization-server-metadata-validation)
- [Spring Security embedded UnboundID LDAP server authentication bypass](https://junglewise.ai/threats/cve-2026-59270-spring-security-embedded-unboundid-ldap-server-authentication)
- [Spring Security WebAuthn user verification bypass in distributed sessions](https://junglewise.ai/threats/cve-2026-47841-spring-security-webauthn-user-verification-bypass-in-distributed)