In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri… (CVE-2026-59355)

In Spring Authorization Server versions 1.5.0 through 1.5.7, the authorization endpoint does not properly validate the request_uri parameter. An attacker can exploit this by sending a request with an invalid request_uri combined with an unvalidated redirect_uri, causing an open redirect vulnerability (CWE-601). This flaw can be used to redirect users to malicious sites under attacker control.

The vulnerability allows an attacker to perform open redirects, potentially leading to phishing or other social engineering attacks by redirecting users to malicious sites. The CVSS score of 6.1 reflects a moderate impact with limited confidentiality and integrity loss, and no impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious with authorization requests and validate redirect URIs externally if possible.