Vulnerability Details CVE-2026-59355
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 13.1%
CVSS Severity
CVSS v3 Score 6.1
References
Products affected by CVE-2026-59355
-
cpe:2.3:a:broadcom:spring_authorization_server:1.5.0
-
cpe:2.3:a:broadcom:spring_authorization_server:1.5.1
-
cpe:2.3:a:broadcom:spring_authorization_server:1.5.2
-
cpe:2.3:a:broadcom:spring_authorization_server:1.5.3
-
cpe:2.3:a:broadcom:spring_authorization_server:1.5.4
-
cpe:2.3:a:broadcom:spring_authorization_server:1.5.5
-
cpe:2.3:a:broadcom:spring_authorization_server:1.5.6
-
cpe:2.3:a:broadcom:spring_authorization_server:1.5.7