CVE-2026-59355
MEDIUM
NVD
CVSS Score
6.1
Severity
MEDIUM
Published
Aug 27, 2026
Vendor
unknown
Description
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.