Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-41706Open Redirect When Using CookieRequestCache
Medium 6.1
In plain English
A medium-severity open redirect in Spring Security from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is used without validation as the post-login redirect target. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-web | 7.0.6 | GHSA-x2r2-rvhq-2mqv |
| Maven | org.springframework.security:spring-security-web | 6.5.11 | GHSA-x2r2-rvhq-2mqv |
| Maven | org.springframework.security:spring-security-web | no fix listed | GHSA-x2r2-rvhq-2mqv |
| Maven | org.springframework.security:spring-security-web | no fix listed | GHSA-x2r2-rvhq-2mqv |
| Maven | org.springframework.security:spring-security-web | no fix listed | GHSA-x2r2-rvhq-2mqv |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Security | 5.7.0 – before 5.7.245.8.0 – before 5.8.266.3.0 – before 6.3.176.4.0 – before 6.4.176.5.0 – before 6.5.10.27.0.0 – before 7.0.5.1 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N