The vulnerability in Spring Security Authorization Server involves improper validation of the request_uri parameter at the authorization endpoint. An attacker can exploit this by submitting a crafted authorization request containing an invalid request_uri and an unvalidated redirect_uri, resulting in an Open Redirect (CWE-601). This can potentially redirect users to untrusted sites. The affected versions are Spring Security 7.0.0 through 7.0.5 and Spring Authorization Server 1.5.0 through 1.5.7. No official patch or remediation level has been provided as of the published date.

Successful exploitation allows an attacker to redirect users to arbitrary, potentially malicious websites via the authorization endpoint. This can facilitate phishing attacks or other social engineering tactics by leveraging the trusted domain of the vulnerable service. The confidentiality and integrity impacts are limited to partial control over redirect destinations, with no direct impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using affected versions or implement strict validation and allowlisting of redirect URIs in their deployment configurations to mitigate open redirect risks.