GHSA-4R8W-73JC-3M7Q Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter

🗓️ 10 Jun 2026 00:31:51Reported by GoogleType

osv

osv🔗 osv.dev👁 6 Views

Open Redirect in Spring Authorization Server via unvalidated request_uri and redirect_uri parameters.

Reporter	Title	Published	Views	Family All 18
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilites	6 Jul 202610:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Security vulnerability that could allow Redirection to Untrusted Sites and Denial of Service (Dos) attacks	26 Jun 202618:27	–	ibm
CNNVD	VMware Spring Security和Spring Authorization Server 输入验证错误漏洞	10 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41008	9 Jun 202623:47	–	cve
Cvelist	CVE-2026-41008 Spring Security Authorization Server Open Redirect via request_uri	9 Jun 202623:47	–	cvelist
EUVD	EUVD-2026-35888	10 Jun 202600:31	–	euvd
F5 Networks	K000162929: Spring Security Authorization Server vulnerability CVE-2026-41008	14 Aug 202617:02	–	f5
Github Security Blog	Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter	10 Jun 202600:31	–	github
NVD	CVE-2026-41008	10 Jun 202600:16	–	nvd
Positive Technologies	PT-2026-48309	9 Jun 202600:00	–	ptsecurity

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41008
github	www.github.com/spring-projects/spring-authorization-server
github	www.github.com/spring-projects/spring-security/releases/tag/7.0.6
spring	www.spring.io/security/cve-2026-41008

12 Aug 2026 16:30Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.16.1

EPSS0.00172

Spring Security Spring Authorization Server Open Redirect request_uri authorization endpoint