CVE-2026-59355

MediumCVSS 6.1/10Last modified Sep 1, 2026

Description

In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri, which can result in an open redirect to an attacker-controlled site.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
VMware	Spring Authorization Server	>= 1.5.0, <= 1.5.7

References

https://spring.io/security/cve-2026-59355Vendor Advisory

Timeline

Published: Aug 27, 2026
Last modified: Sep 1, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-593576.5Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusi CVE-2026-593587.6Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid u CVE-2026-59369.8An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinat CVE-2026-59375.5Insufficient parameter verification leads to the occurrence of format errors in files, which will trigger an unhandled "std::invalid_argumen CVE-2026-59385.5Improper control flow management allows a crafted document action chain to cause modal dialog reentry on the main thread, resulting in UI fr CVE-2026-59395.5A crafted XFA PDF can trigger a use-after-free condition during calculate event processing, causing the application to crash and resulting i CVE-2026-59405.5Calling a function that triggers a UI refresh after removing comments via a script may access an invalidated object, leading to program cras CVE-2026-59417.1Parsing logic flaws cause non-signature data to be misidentified as valid signatures when processing malformed form field hierarchies, leadi CVE-2026-59425.5Flaws in page lifecycle management allow document structure changes to desynchronize internal component states, causing subsequent operation CVE-2026-59437.8Document structural anomalies caused inconsistencies between page element relationships and internal index states. When scripts triggered do CVE-2026-59448.2An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an A CVE-2026-59467.5Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CH