This vulnerability arises when a Spring MVC or Spring WebFlux application uses a catch-all mapping ("/**") and does not explicitly specify the view name, enabling an attacker to exploit the redirect: prefix to cause an HTTP 302 redirect to an arbitrary external URL. This open redirect (CWE-601) can be leveraged to redirect users to untrusted sites, potentially facilitating phishing or other social engineering attacks. The affected versions include Spring Framework 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. No official patch or remediation level is stated in the available data, and no known exploits in the wild have been reported.

The vulnerability allows attackers to redirect users to arbitrary external sites via crafted URLs, which can be used for phishing or redirecting users to malicious sites. The impact is limited to confidentiality and integrity (low impact), with no direct impact on availability. The CVSS vector indicates the attack requires user interaction and has a high attack complexity with no privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, developers should avoid configuring catch-all mappings ("/**") without explicitly specifying view names or implement validation to restrict redirect targets. Monitor vendor communications for patches or official mitigations.