CVE-2026-59355 PUBLISHED

Spring Authorization Server: Open Redirect via request_uri parameter

Assigner: vmware
Reserved: 04.07.2026 Published: 27.08.2026 Updated: 27.08.2026

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS Score: 6.1

Product Status

Vendor VMware
Product Spring Authorization Server
Versions Default: unaffected
  • affected from 1.5.0 to 1.5.7 (incl.)
  • Version 1.5.8 is unaffected
  • Version 1.5.7.1 is unaffected

Solutions

Upgrade to Spring Authorization Server 1.5.8 (OSS) or 1.5.7.1 (Enterprise Support customers). No additional mitigation is required after upgrading.

Credits

  • Jon Kjennbakken (Vipps MobilePay) finder

References

Problem Types

  • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') CWE