Vulnerability · Published Jun 8, 2026 · Assigned by VulDB
CVE-2026-11477hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirect
Medium 4.3
In plain English
A medium-severity open redirect in hsweb-framework from hs-web. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
A vulnerability was detected in hs-web hsweb-framework up to 5.0.1. This affects the function OAuth2Client of the file hsweb-authorization/hsweb-authorization-oauth2/src/main/java/org/hswebframework/web/oauth2/server/OAuth2Client.java of the component OAuth2 Client. The manipulation results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as c2882679a9125cea52678151af5ae213cbd52579. Applying a patch is advised to resolve this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.hswebframework.web:hsweb-authorization-oauth2 | no fix listed | GHSA-fxr3-gvm4-m8vc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hs-web | hsweb-framework | 5.0.05.0.1 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
References
- VDB-369097 | hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirect vdb-entry, technical-description
- VDB-369097 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-11477 | CVE Analysis and Report third-party-advisory
- Submit #833962 | GitHub hsweb-framework 5.0.0 Open Redirect third-party-advisory
- https://github.com/hs-web/hsweb-framework/issues/354 exploit, issue-tracking
- https://github.com/hs-web/hsweb-framework/pull/355 issue-tracking, patch
- https://github.com/hs-web/hsweb-framework/commit/c2882679a9125cea52678151af5ae213cbd52579 patch
- https://github.com/hs-web/hsweb-framework/ product