Description

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-27T10:16:36.197Z",
  "pubdate": "2026-08-27T10:16:36.197Z",
  "executiveSummary": "Spring Authorization Server versions 1.5.0 through 1.5.7 are susceptible to an open redirect vulnerability caused by insufficient validation of the 'request_uri' parameter at the authorization endpoint.\nThe vulnerability allows an unauthenticated attacker to manipulate the authentication flow by providing a malicious combination of 'request_uri' and 'redirect_uri' parameters.\nSuccessful exploitation facilitates the redirection of end-users to arbitrary attacker-controlled domains, posing significant risks related to phishing, credential theft, and social engineering.\nThe flaw stems from a lack of rigorous verification on input parameters during the initial stages of the OAuth 2.0 authorization request, failing to enforce strict allow-listing of redirect destinations.\nThis vulnerability is critical for identity providers where user trust in the redirection process is essential for security. No specific authentication or elevated privileges are required for an attacker to trigger this behavior, as the flaw exists within the public-facing authorization endpoint.",
  "technicalDetails": "The vulnerability resides in the authorization endpoint logic of Spring Authorization Server, which fails to adequately sanitize or validate the 'request_uri' parameter when processed alongside an unvalidated 'redirect_uri'.\nIn the OAuth 2.0 protocol, the 'request_uri' parameter is intended to point to a secure, pre-defined location containing request objects; however, the implementation in versions 1.5.0 through 1.5.7 allows for the injection of improperly vetted URI structures.\nThe exploitation flow begins when an attacker crafts a malicious authorization request sent to the server. The attacker supplies a 'request_uri' that the server fails to properly resolve or validate against an established security policy. Simultaneously, the attacker includes a 'redirect_uri' parameter that is not cross-referenced against a registered list of trusted client callbacks.\nBecause the server logic performs insufficient validation, it improperly trusts the combination of these inputs during the processing of the authorization request. When the server redirects the user-agent after the initiation phase, it utilizes the attacker-provided URI rather than adhering to a strict, pre-configured list of allowed endpoints.\nThis effectively transforms the authorization server into an open redirector. An attacker can leverage this by crafting a link that appears to originate from the legitimate authorization server but forces the user's browser to navigate to a malicious destination upon interaction.\nThe scope of this vulnerability is significant due to the nature of the authorization server, which users trust for identity assertion. By redirecting a user to a malicious site, the attacker can perform phishing attacks that appear legitimate, potentially capturing session cookies, authorization codes, or user credentials depending on the implementation context of the relying party.\nThe flaw manifests specifically during the request handling phase of the authorization endpoint, before any actual authentication or authorization decisions are enforced by the underlying identity provider backend. Because the server processes these inputs prematurely without validation, it fails to verify if the destination is a legitimate part of the registered client application's callback configuration."
}