CVE-2026-41706 is an open redirect vulnerability (CWE-601) in Spring Security's CookieRequestCache and CookieServerRequestCache. These components save the full absolute URL of the original request in a browser cookie to redirect users after successful authentication. However, the URL stored is not validated before use, enabling an attacker to craft a malicious URL that redirects users to untrusted external sites after login. The vulnerability affects multiple Spring Security versions from 5.7.0 up to 7.0.5 in specified ranges.

Successful exploitation can lead to users being redirected to attacker-controlled or untrusted websites after authentication, potentially facilitating phishing or other social engineering attacks. The vulnerability has a CVSS 3.1 score of 6.1 (medium severity), indicating limited confidentiality and integrity impact but no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider implementing custom validation of redirect URLs or disabling automatic post-login redirects that use unvalidated URLs stored in cookies.