Open Redirect

🗓️ 14 Aug 2026 09:19:19Reported by Veracode Vulnerability DatabaseType

Spring Security Open Redirect in CookieRequestCache and CookieServerRequestCache via unvalidated cookie URL as redirect target.

Reporter	Title	Published	Views	Family All 74
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	6 Aug 202620:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilites	6 Jul 202610:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Security vulnerability that could allow Redirection to Untrusted Sites	26 Jun 202618:25	–	ibm
Chainguard	CVE-2026-41706 vulnerabilities	14 Aug 202602:16	–	cgr
CNNVD	Spring Security 输入验证错误漏洞	10 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41706	9 Jun 202623:47	–	cve
Cvelist	CVE-2026-41706 Open Redirect When Using CookieRequestCache	9 Jun 202623:47	–	cvelist
EUVD	EUVD-2026-35896	10 Jun 202600:31	–	euvd
F5 Networks	K000162895: Spring Framework CookieRequestCache vulnerability CVE-2026-41706	12 Aug 202617:29	–	f5
Github Security Blog	Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache	10 Jun 202600:31	–	github

Vulners

Node

Source	Link
github	www.github.com/spring-projects/spring-security/commit/a14c9d66b15946d2040a3681b55fe29ac145c5c9
github	www.github.com/spring-projects/spring-security/releases/tag/6.5.11
spring	www.spring.io/security/cve-2026-41706

12 Sep 2026 03:48Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.16.1

EPSS0.00297

SSVC