CVE-2026-41008

6.1 Moyenne

Publiée le 10/06/2026 à 02:16 · Modifiée le 23/07/2026 à 11:10 · Analysée par le NVD · Source : security@vmware.com

Description

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, which can lead to an Open Redirect vulnerability. Affected versions: Spring Security 7.0.0 through 7.0.5. Spring Authorization Server 1.5.0 through 1.5.7.

Traduire en français

Produits concernés

Spring Security
Spring Authorization Server
Broadcom spring authorization server
Vmware spring security

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.1 Moyenne	security@vmware.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-601

Références

https://spring.io/security/cve-2026-41008 Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories