CVE-2026-41008 Spring Security Authorization Server Open Redirect via request_uri
Attackers can exploit insufficient validation in the authorization endpoint to redirect users to malicious sites, requiring an upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-41008?
CVE-2026-41008 is a medium-severity vulnerability in Spring Authorization Server, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, which can lead to an Open Redirect vulnerability.
Affected versions: Spring Security 7.0.0 through 7.0.5. Spring Authorization Server 1.5.0 through 1.5.7.
Weakness: CWE-601
Which versions are affected by CVE-2026-41008?
4 open source packages ship an affected version, including org.springframework.security:spring-security-oauth2-authorization-server. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.security:spring-security-oauth2-authorization-server Maven | From 1.5.0 | 1.5.8 |
org.springframework.security:spring-security-oauth2-authorization-server Maven | From 1.5.0 | 1.5.8 |
org.springframework.security:spring-security-oauth2-authorization-server Maven | From 7.0.0 | 7.0.6 |
org.springframework.security:spring-security-oauth2-authorization-server Maven | From 7.0.0 | 7.0.6 |
Products include Broadcom Spring Authorization Server, Vmware Spring Security.
How do I fix CVE-2026-41008?
Upgrade org.springframework.security:spring-security-oauth2-authorization-server to a fixed version for your release line: 1.5.8 or 7.0.6.
Is CVE-2026-41008 being exploited?
There is no known exploitation of CVE-2026-41008 in the wild and no public exploit code.
Other vulnerabilities in Spring Authorization Server
Sources
Also known as GHSA-4r8w-73jc-3m7q.