Description

UrlHandlerFilter can be vulnerable to an open redirect when configured with very broadly matching patterns. The issue applies to the filter variants in both Spring MVC and Spring WebFlux. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-27T06:17:18.290Z",
  "pubdate": "2026-08-27T06:17:18.290Z",
  "executiveSummary": "UrlHandlerFilter within Spring Framework is susceptible to an open redirect vulnerability, stemming from overly permissive URL pattern matching configurations.\nThe vulnerability allows an unauthenticated remote attacker to redirect users to arbitrary malicious domains by manipulating the input parameters processed by the filter.\nThis flaw affects both Spring MVC and Spring WebFlux variants.\nThe impact includes potential phishing, credential harvesting, and bypass of domain-based security controls.\nThe risk is highly dependent on the application-specific configuration of the URL patterns; when patterns are defined too broadly, the filter fails to validate the destination URL adequately, enabling malicious redirection payloads.\nSuccessful exploitation requires the attacker to entice a victim into clicking a specially crafted URL that leverages the vulnerable filter's redirection logic.\nAffected products include Spring Framework versions 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19.",
  "technicalDetails": "The vulnerability resides within the UrlHandlerFilter component, which is responsible for intercepting and managing URL routing or redirection logic. The root cause is the mechanism by which the filter evaluates incoming request paths against configured patterns. When these patterns are defined with insufficient specificity, the filter can be coerced into treating user-supplied input as a legitimate internal path, subsequently performing a redirect to an external, attacker-controlled host.\nThe exploitation flow begins when an attacker identifies a URL parameter or path segment processed by UrlHandlerFilter. By crafting a URL that incorporates a fully qualified external address—often leveraging various bypass techniques such as protocol obfuscation or URL encoding—the attacker forces the filter to interpret the malicious input as a valid redirect target. Because the filter lacks rigorous validation for the destination domain, the application issues a 3xx HTTP response code (typically a 302 Found) to the victim's browser, instructing the user agent to navigate to the attacker's server.\nThis behavior facilitates a classic open redirect attack. The victim, initially intending to interact with the trusted host, is transparently routed to an external site. This is particularly dangerous as the initial navigation is performed under the context of the trusted domain, which can bypass certain client-side security policies and provide the attacker with a high degree of social engineering credibility.\nAffected components include the Spring MVC and Spring WebFlux variants of the UrlHandlerFilter. The vulnerability affects Spring Framework versions 7.0.0-7.0.8 and 6.2.0-6.2.19. The filter does not perform sufficient path validation to ensure that redirection targets are restricted to a whitelist of allowed domains or relative internal paths, effectively delegating trust to user-supplied input.\nPost-exploitation impact includes the successful execution of phishing campaigns, distribution of malware, and the potential theft of session tokens or sensitive data if the redirection is paired with additional web-based attack vectors. The vulnerability is typically accessible over the network without the need for prior authentication, assuming the application exposes the vulnerable filter to external users."
}