CVE-2026-41706

MediumCVSS 6.1/10Last modified Jul 23, 2026

Description

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is used without validation as the post-login redirect target.

Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Jun 10, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-417077.4Authentication Bypass by Capture-replay vulnerability in Spring Spring Security allows Spring Security's DPoPProofJwtDecoderFactory containsCVE-2026-417087.5In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. TheCVE-2026-417092.7VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations CVE-2026-41716.3A security vulnerability has been detected in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functionaCVE-2026-417105.9An attacker can craft a large number of unique requests that trigger a failure, exhausting the capacity of the application-wide stateful retCVE-2026-417115.9Applications using Spring Data Commons may be vulnerable to a Denial of Service (DoS) attack leading to a StackOverflowException when parsinCVE-2026-417127.5Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data expoCVE-2026-417138.2A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. ApplicatioCVE-2026-417144.0Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri("amqps://...") without also calling setUseSSL(truCVE-2026-417156.1In specific scenarios involving HTTP redirects from a secure to an insecure endpoint, the Reactor Netty HTTP client may leak credentials. InCVE-2026-417167.5Spring Data's internal property-lookup cache accepts and permanently retains attacker-supplied strings as cache keys, allowing heap exhaustiCVE-2026-417178.1Spring Data MongoDB contains a SpEL (Spring Expression Language) expression injection vulnerability. The issue occurs during parameter bindi