← CVE Intelligence

CVE-2026-59355

Spring Authorization Server: Open Redirect via request_uri parameter PUBLISHED

Description (CNA)

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.

Affected (CNA)

Vendor / productVersions
VMware / Spring Authorization Serveraffected 1.5.0 through 1.5.7; unaffected 1.5.8; unaffected 1.5.7.1

CWE

CWE-601

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.