CVE-2026-41706 Details
Description
Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is used without validation as the post-login redirect target. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
A vulnerability exists in Spring Security's CookieRequestCache and CookieServerRequestCache components, which store the pre-authentication request URL in a browser cookie. This allows users to be redirected back to their intended destination after logging in. However, in the affected versions, the full absolute URL is saved in the cookie and used as the post-login redirect target without validation. This issue can lead to open redirect vulnerabilities, where an attacker can manipulate the redirect URL to point to a malicious site.
Users should upgrade to Spring Security versions 5.7.24, 5.8.26, 6.3.17, 6.4.17, 6.5.11, or 7.0.6, depending on their current version.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://spring.io/security/cve-2026-41706 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| vmware spring security | < 5.7.24 >= 5.8.0, < 5.8.26 >= 6.3.0, < 6.3.17 >= 6.4.0, < 6.4.17 >= 6.5.0, < 6.5.10.2 >= 7.0.0, < 7.0.5.1 |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jul 17, 2026 | Modified Analysis | [email protected] |
| Jun 27, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 10, 2026 | New CVE Received | [email protected] |