CVE-2026-59355: CWE-601: URL Redirection to Untrusted Site ('Open Redirect') in VMware Spring Authorization Server

In VMware Spring Authorization Server versions 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can exploit this by crafting a request containing an invalid request_uri paired with an unvalidated redirect_uri, resulting in an open redirect to an attacker-controlled site. This vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site). No official patch or remediation level has been provided in the available data.

Successful exploitation of this vulnerability allows an attacker to redirect users to malicious websites via the authorization endpoint. This can be used to facilitate phishing attacks or other social engineering tactics by exploiting user trust in the legitimate domain. The impact includes limited confidentiality and integrity loss but no direct availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when handling URLs involving the authorization endpoint and consider implementing additional validation or filtering of redirect URIs in their deployment to mitigate potential abuse.