CVE-2026-41008

Name of the Vulnerable Software and Affected Versions Spring Security versions 7.0.0 through 7.0.5 Spring Authorization Server versions 1.5.0 through 1.5.7

Description The authorization endpoint performs insufficient validation of the request uri parameter. An attacker can craft a malicious authorization request containing an invalid request uri and an arbitrary, unvalidated redirect uri, which can lead to an Open Redirect, a situation where a user is unexpectedly redirected to an external, malicious website.

Recommendations Update Spring Security to a version later than 7.0.5. Update Spring Authorization Server to a version later than 1.5.7.