Advisoriesby IbisVMwareCVE-2026-59355
VMware Spring Authorization Server: open redirect
No fix yet
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Spring Authorization Server Product | >= 1.5.0, <= 1.5.7 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-601