CVE-2026-59355 in Spring Authorization Server
Summary
by MITRE • 08/27/2026
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in Spring Authorization Server versions 1.5.0 through 1.5.7 represents a critical flaw in the implementation of the OAuth 2.0 and OIDC authorization flows, specifically concerning the handling of the request_uri parameter. This security issue stems from insufficient validation mechanisms within the authorization endpoint logic. In standard OpenID Connect implementations, the request_uri parameter allows clients to reference a JSON file containing request parameters rather than embedding them directly in the URL query string. While this feature is designed to enhance privacy and reduce URL length, its implementation requires rigorous verification of both the URI format and the content it points to. The flaw arises because the server fails to adequately validate the structure or accessibility of the provided request_uri while simultaneously neglecting to enforce strict validation on the redirect_uri parameter when these two are used in conjunction.
The technical mechanism of this vulnerability allows an attacker to exploit the lack of input sanitization by crafting a malicious authorization request that pairs an invalid or malformed request_uri with a carefully selected, unvalidated redirect_uri. Because the server does not properly verify whether the request_uri is valid before proceeding with the authentication flow, it may bypass certain security checks associated with standard parameter parsing. Consequently, when the user completes their interaction at the authorization endpoint, the system redirects them to the attacker-controlled domain specified in the redirect_uri without ensuring that this destination aligns with pre-registered allowed origins or passes necessary integrity checks. This behavior effectively creates an open redirect vulnerability within a critical authentication component of the application ecosystem.
The operational impact of this flaw is severe, particularly for applications relying on Spring Authorization Server as their identity provider. An attacker can leverage this open redirect to facilitate phishing attacks by directing users from what appears to be a legitimate login page to a malicious site designed to harvest credentials or session tokens. Furthermore, in scenarios where the authorization server issues ID tokens or access codes upon successful authentication, an attacker could potentially intercept these sensitive artifacts if they control the redirect endpoint and can trick a victim into authenticating there. This undermines the trust model of OAuth 2.0 and OpenID Connect, as it allows for the hijacking of user sessions and potential unauthorized access to protected resources associated with the compromised identity provider.
From an industry standards perspective, this vulnerability aligns closely with CWE-601, which describes URL Redirection to Untrusted Site (Open Redirect). The failure to validate input parameters before performing a state-changing action or redirect is also indicative of weaknesses often categorized under CWE-20, Improper Input Validation. In the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques related to Credential Access and Phishing, specifically allowing attackers to bypass security controls that rely on domain validation during authentication flows. The exploitation vector typically involves social engineering combined with technical manipulation of URL parameters, making it a high-risk issue for any public-facing identity service.
To mitigate this risk, organizations running affected versions must immediately upgrade Spring Authorization Server to version 1.5.8 or later, where the validation logic has been corrected to ensure that both request_uri and redirect_uri are properly validated against allowlists and format requirements. For environments where an immediate patch is not feasible, temporary mitigations include implementing a Web Application Firewall rule set designed to detect and block malformed authorization requests containing suspicious combinations of parameters. Additionally, developers should enforce strict validation on the client side by ensuring that only pre-registered redirect URIs are accepted during the initial registration phase and verifying that any dynamic parameter injection attempts fail gracefully without triggering redirects. Regular security audits focusing on OAuth flow implementations can further help identify similar logic flaws in custom authentication modules.