K000162929: Spring Security Authorization Server vulnerability CVE-2026-41008

🗓️ 14 Aug 2026 17:02:40Reported by f5Type

f5🔗 my.f5.com👁 5 Views

Insufficient request_uri validation in Spring Security 7.0.0-7.0.5 causes Open Redirect via unvalidated redirect_uri.

Reporter	Title	Published	Views	Family All 18
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilites	6 Jul 202610:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Security vulnerability that could allow Redirection to Untrusted Sites and Denial of Service (Dos) attacks	26 Jun 202618:27	–	ibm
CNNVD	VMware Spring Security和Spring Authorization Server 输入验证错误漏洞	10 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41008	9 Jun 202623:47	–	cve
Cvelist	CVE-2026-41008 Spring Security Authorization Server Open Redirect via request_uri	9 Jun 202623:47	–	cvelist
EUVD	EUVD-2026-35888	10 Jun 202600:31	–	euvd
Github Security Blog	Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter	10 Jun 202600:31	–	github
NVD	CVE-2026-41008	10 Jun 202600:16	–	nvd
OSV	GHSA-4R8W-73JC-3M7Q Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter	10 Jun 202600:31	–	osv
Positive Technologies	PT-2026-48309	9 Jun 202600:00	–	ptsecurity

14 Aug 2026 17:02Current

5.5Medium risk

Vulners AI Score5.5

CVSS 3.16.1

EPSS0.00172

SSVC