CVE-2026-41008: broadcom spring_authorization_server Open Redirect
Vulnerability summary
CVE-2026-41008 is a medium (CVSS 6.1) Open Redirect vulnerability in broadcom spring_authorization_server. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.3% of scored vulnerabilities.
Timeline
- 09-06-2026PublishedVulnerability first disclosed.
- 27-06-2026Last modifiedVulnerability information updated.
Description
Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a malicious authorization request containing an invalid request_uri and an arbitrary, unvalidated redirect_uri, which can lead to an Open Redirect vulnerability. Affected versions: Spring Security 7.0.0 through 7.0.5. Spring Authorization Server 1.5.0 through 1.5.7.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · MavenEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- NVDNIST6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
15%
Versus all other CVEs
30-day change
+0.07 pp
From 0.18% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Spring2 products
- spring authorization server≥ 1.5.0, < 1.5.7.1
- spring security≥ 7.0.0, < 7.0.5.1
Broadcom1 product
- spring_authorization_server≥ 1.5.0, < 1.5.7.1
Org.springframework.security1 product
- spring-security-oauth2-authorization-server≥ 7.0.0, < 7.0.6 | ≥ 1.5.0, < 1.5.8
Vmware1 product
- spring_security≥ 7.0.0, < 7.0.5.1
4 vendors · 5 products
