The vulnerability in Spring Security Authorization Server involves improper validation of the request_uri parameter at the authorization endpoint. An attacker can exploit this by sending a crafted authorization request containing an invalid request_uri and an unvalidated redirect_uri, leading to an Open Redirect (CWE-601). This can potentially redirect users to untrusted sites. The affected versions are Spring Security 7.0.0 through 7.0.5 and Spring Authorization Server 1.5.0 through 1.5.7. No official patch or remediation level has been provided in the available data.

Successful exploitation allows an attacker to redirect users to arbitrary, potentially malicious websites via the authorization endpoint. This can facilitate phishing attacks or other social engineering tactics by misleading users about the destination of redirects. The impact includes limited confidentiality and integrity loss, with no direct availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when handling authorization requests and consider implementing additional validation or monitoring of redirect URIs in their deployment. Avoid trusting unvalidated redirect_uri parameters.