Open Redirect Vulnerability in Spring Security CookieRequestCache and CookieServerRequestCache
CVE-2026-41706

6.1MEDIUM

Key Information:

Vendor

Spring

Status
Spring Security
Vendor
CVE Published:
9 June 2026

What is CVE-2026-41706?

The vulnerability in Spring Security's CookieRequestCache and CookieServerRequestCache allows attackers to manipulate redirection paths by storing full absolute URLs in a browser cookie. This pre-authentication request URL, which is used post-login without proper validation, presents a significant security risk, enabling malicious redirects to untrusted sites.

Affected Version(s)

Spring Security 5.7.0 < 5.7.24

Spring Security 5.8.0 < 5.8.26

Spring Security 6.3.0 < 6.3.17

References

https://spring.io/security/cve-2026-41706

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.