CVE-2026-59355 VMware CVE debrief

Who should care

Security teams and administrators responsible for Spring Authorization Server instances, particularly those using versions 1.5.0 through 1.5.7, should review and update their systems to mitigate potential open redirect attacks. They should also verify affected deployments, implement additional validation for request_uri and redirect_uri parameters, and monitor for suspicious redirect activity. Vulnerability management and security teams should prioritize this issue due to its potential impact on user security and the likelihood of exploitation in the wild.

Technical summary

Insufficient validation of the request_uri parameter in Spring Authorization Server versions 1.5.0 through 1.5.7 allows an attacker to craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, potentially resulting in an open redirect to an attacker-controlled site. This vulnerability impacts the authorization endpoint, enabling attackers to redirect users to malicious sites. Security teams must review and update their systems to mitigate potential open redirect attacks.

Defensive priority

Medium-priority defensive review recommended due to insufficient validation in Spring Authorization Server versions 1.5.0 through 1.5.7.

Recommended defensive actions

• Review and update Spring Authorization Server to version 1.5.7.1 or later
• Implement additional validation for request_uri and redirect_uri parameters
• Monitor for suspicious redirect activity
• Verify and restrict allowed redirect URIs
• Conduct thorough inventory checks for affected versions

Evidence notes

Evidence from official CVE Program record and NIST NVD detail page indicates insufficient validation of request_uri parameter in Spring Authorization Server versions 1.5.0 through 1.5.7, potentially leading to open redirect attacks. Security teams should verify affected deployments, review vendor advisories, and monitor for suspicious activity. Defenders should focus on validating request_uri and redirect_uri parameters, restricting allowed redirect URIs, and conducting thorough inventory checks for affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.