CVE-2026-41008 Spring Security Authorization Server Open Redirect via request_uri

🗓️ 09 Jun 2026 23:47:07Reported by vmwareType

Spring Security Authorization Server allows open redirects via invalid request_uri and unvalidated redirect_uri.

Reporter	Title	Published	Views	Family All 16
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilites	6 Jul 202610:01	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Security vulnerability that could allow Redirection to Untrusted Sites and Denial of Service (Dos) attacks	26 Jun 202618:27	–	ibm
CNNVD	VMware Spring Security和Spring Authorization Server 输入验证错误漏洞	10 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41008	9 Jun 202623:47	–	cve
Cvelist	CVE-2026-41008 Spring Security Authorization Server Open Redirect via request_uri	9 Jun 202623:47	–	cvelist
EUVD	EUVD-2026-35888	10 Jun 202600:31	–	euvd
F5 Networks	K000162929: Spring Security Authorization Server vulnerability CVE-2026-41008	14 Aug 202617:02	–	f5
Github Security Blog	Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter	10 Jun 202600:31	–	github
NVD	CVE-2026-41008	10 Jun 202600:16	–	nvd
OSV	GHSA-4R8W-73JC-3M7Q Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter	10 Jun 202600:31	–	osv