CVE-2026-11477

Name of the Vulnerable Software and Affected Versions hs-web hsweb-framework versions prior to 5.0.2

Description An open redirect issue exists in the OAuth2 Client component. A remote attacker can manipulate the OAuth2Client() function within the file hsweb-authorization/hsweb-authorization-oauth2/src/main/java/org/hswebframework/web/oauth2/server/OAuth2Client.java to redirect users to an arbitrary external site.

Recommendations Apply patch c2882679a9125cea52678151af5ae213cbd52579 to resolve the issue. As a temporary workaround, restrict access to the OAuth2Client() function until the patch is applied.