medium6.1
CVE-2026-59355
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter.
Impact
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Broadcom | Spring Authorization Server | from 1.5.0 before 1.5.7.1 |