CVE-2026-47883: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') in Spring Spring Framework

The UrlHandlerFilter in Spring Framework versions 7.0.0 to 7.0.8 and 6.2.0 to 6.2.19 can be vulnerable to an open redirect (CWE-601) when configured with broadly matching URL patterns. This affects both Spring MVC and Spring WebFlux filter variants. The vulnerability allows an attacker to redirect users to untrusted external sites, potentially facilitating phishing or other social engineering attacks. No official remediation or patch information is provided in the available data.

Successful exploitation of this vulnerability could allow attackers to redirect users to malicious websites, potentially leading to phishing attacks or other user deception. The impact is limited to confidentiality and integrity as indicated by the CVSS vector (C:L/I:L/A:N). There is no known active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should review and tighten the configuration of UrlHandlerFilter patterns to avoid broadly matching patterns that could enable open redirects.