CVE-2026-59355

Executive Summary

CVE-2026-59355 is an open redirect vulnerability affecting Spring Authorization Server versions 1.5.0 through 1.5.7, as identified by Broadcom. The flaw arises from insufficient validation of the request_uri parameter at the authorization endpoint, which, when combined with an unvalidated redirect_uri, allows an attacker to redirect users to an attacker-controlled external site. With a CVSSv3.1 base score of 6.1 (Medium) and a network attack vector requiring user interaction but no privileges, this flaw primarily enables phishing, credential harvesting, and trust abuse against organizations relying on this OAuth 2.1 / OpenID Connect authorization server. A patch is claimed in a single source but has not been independently confirmed, so enterprise teams should treat affected deployments as actively at risk.

Technical Analysis

The vulnerability resides within the authorization endpoint of Spring Authorization Server, which implements the OAuth 2.1 and OpenID Connect authorization code flow. During the authorization request processing, the server validates several parameters to decide whether to redirect a user's browser to a specified location. According to the NVD description, the request_uri parameter is subject to insufficient validation — the server does not properly verify that a request_uri value conforms to expected constraints (e.g., that it is an absolute/relative URI matching an allowed pattern, or that it refers to a legitimately registered request object). Concurrently, the redirect_uri parameter is not validated in this code path. Notably, the description indicates that neither parameter is validated in combination, meaning the usual defense-in-depth check that would fail a request when either parameter is malformed is bypassed.

The attack mechanism works at the HTTP parameter level: an attacker crafts an authorization request (GET /oauth2/authorize?...) containing a malicious request_uri value that references an attacker-controlled endpoint, paired with a redirect_uri pointing to an external site. Because the authorization server trusts the redirect_uri without checking it against registered client configurations (when combined with the invalid request_uri), the server issues an HTTP 302 redirect response that sends the user's browser to the attacker's site.

The underlying weakness maps to CWE-601 — URL Redirection to Untrusted Site ('Open Redirect'). The flaw class is a logic error in parameter validation ordering: the server must reject requests where either request_uri is invalid or redirect_uri is unregistered. The bug allows these two invalid conditions to be combined, bypassing both checks. It is important to note the NVD description does not enumerate which validation checks are skipped or which exception paths are taken; the technical detail is limited to the "insufficient validation" statement. The vulnerability is server-side but requires user interaction (target user must be tricked into clicking a crafted link), consistent with the CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N — reflected cross-site scripting-like impact scope.

No specific code-level details (class names, method names, or endpoint paths beyond "authorization endpoint") are provided in the NVD description, so implementation-level analysis must remain at the class level.

Exploitation Scenarios

The following exploitation chain is inferred from the vulnerability class and NVD description. No public PoC or exploit code exists as of this report.

Step 1 — Reconnaissance / Target Identification The attacker identifies a publicly accessible Spring Authorization Server instance running a vulnerable version (1.5.0 through 1.5.7). This can be detected through HTTP response headers (e.g., server banners or framework-specific markers), error page signatures, or by observing the standard OAuth2 authorization endpoint path (/oauth2/authorize) in expected OpenID Connect discovery documents.

Step 2 — Triggering the Flaw The attacker crafts a malicious authorization request URL that includes two poisoned parameters: a request_uri value that is invalid (e.g., a non-URI string, a URI referencing an unregistered resource, or a crafted value that triggers a parsing exception) and a redirect_uri that points to an attacker-controlled domain (e.g., https://evil.example.com/capture). The crafted URL is delivered to the victim via phishing email, social media message, or a link embedded in a legitimate-looking webpage.

Step 3 — Payload Execution / Redirect When the victim clicks the crafted link, their browser sends the authorization request to the vulnerable server. Due to insufficient validation, the server processes the invalid request_uri without rejecting the request and subsequently honors the unvalidated redirect_uri, issuing an HTTP 302 redirect to the attacker's domain. The victim's browser follows the redirect, landing on the attacker-controlled site.

Step 4 — Post-Exploitation Impact Once on the attacker's site, the victim may encounter a realistic phishing page mimicking the legitimate service, prompting them to enter credentials or other sensitive data. In OAuth contexts, the attacker may also capture any intermediate authorization artifacts (e.g., authorization codes) if the redirect carries them, potentially enabling token theft. The primary impact is credential phishing and brand impersonation; the integrity impact in the CVSS vector (I:L) reflects the potential to modify the user's session state via open redirect.

No PoC exists publicly (PoC Status: None). The attack chain is inferred from the CWE-601 class since specific implementation details were not disclosed in the NVD description.

Impact Assessment

The business impact of CVE-2026-59355 is moderate but with a wide effective surface area, given that the Spring Authorization Server is a central identity component. The CVSS subscores break down as: Confidentiality Impact: Low (C:L), Integrity Impact: Low (I:L), Availability Impact: None (A:N). The scope is Changed (S:C), meaning the compromised resource (the user's browser session) is outside the authorization server's security authority. The vector AV:N indicates network exploitability, AC:L means no special conditions are required, PR:N requires no privileges, and UI:R mandates user interaction.

For affected organizations, the practical consequences are:

• Phishing Amplification: Attackers can leverage the trusted domain of the authorization server to host phishing URLs, bypassing URL reputation filters that trust legitimate OAuth domains.
• Credential Harvesting: Users redirected to attacker-controlled pages may be tricked into submitting credentials, which could be reused against the actual service.
• Brand Abuse: The open redirect makes the legitimate service's domain a vector for malicious campaigns, damaging trust.
• Blast Radius: Any user who visits a crafted link is affected; this is not limited to authenticated users. Given the server is public-facing (typical for OAuth providers), the potential victim population is large.

The EPSS score of 0.00226 (13.1% percentile) indicates low active exploitation probability, but the code being widely deployed in enterprise authorization flows elevates strategic risk, especially since the patch is not independently confirmed.

Detection Guidance

Sigma Rule

Detects HTTP requests to an authorization endpoint containing both a request_uri and a redirect_uri pointing to external domains.

title: Spring Authorization Server Open Redirect Attempt (CVE-2026-59355)
id: 9f8c2d4e-1a2b-4c5d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects crafted authorization requests with invalid request_uri and redirect_uri to untrusted external domains in Spring Authorization Server.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-59355
author: Valters IT Threat Intel
date: 2026/02/15
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for Spring Authorization Server'
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains|all:
            - 'request_uri='
            - 'redirect_uri='
    filter_external_redirect:
        cs-uri-query|contains|all:
            - 'redirect_uri=https://'
            - 'redirect_uri=http://'
    condition: selection and filter_external_redirect
falsepositives:
    - Legitimate OAuth clients using external redirect URIs
    - Authorization requests using the request_uri parameter legitimately
level: medium
tags:
    - attack.t1190
    - cve.2026-59355

YARA Rule

Detects exploit strings in log files or captured HTTP traffic containing both parameters.

rule CVE_2026_59355_Spring_Auth_Open_Redirect {
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects crafted requests targeting Spring Authorization Server request_uri open redirect CVE-2026-59355"
        cve = "CVE-2026-59355"
        date = "2026-02-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-59355"
    strings:
        $a = "request_uri=" nocase
        $b = "redirect_uri=" nocase
        $c = "/oauth2/authorize" nocase
        $d = "http://" ascii
        $e = "https://" ascii
    condition:
        uint16(0) == 0x0a0d and all of them
}

Suricata IDS Rule

Detects HTTP GET requests containing both request_uri and redirect_uri parameters in the query string.

alert http any any -> $HOME_NET any (msg:"CVE-2026-59355 - Spring Authorization Server Open Redirect Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"request_uri"; nocase; http.uri; content:"redirect_uri"; nocase; http.uri; content:"http://"; nocase; sid:202659355; rev:1; metadata:attack_target Web_Server, cve CVE-2026-59355, deploy_first 2026_02_15, tag Open_Redirect;)

Elastic Detection

Detects web transactions with both malicious parameters in the URI.

sequence by source.ip with maxspan=10s
    [ network where event.category == "web" and
        url.path == "/oauth2/authorize" and
        url.query contains "request_uri=" and
        url.query contains "redirect_uri=" and
        url.query contains "http://" ]

Splunk SPL Query

Detects suspicious authorization requests in web access logs.

index=weblogs sourcetype=access_combined
| eval requri = replace(_raw, "\"", " ")
| search "/oauth2/authorize" "request_uri=" "redirect_uri=" "http://"
| rex field=requri "redirect_uri=(?<redirect_target>[^&\s]+)"
| eval is_external = if(match(redirect_target, "(?i)^https?://(?!.*(yourdomain\.com|trusted-client\.com)).*$"), 1, 0)
| where is_external=1
| stats count by src_ip, uri, status, _time
| sort - _time

Wazuh OSSEC Rule

Detects the vulnerable request pattern in Apache/nginx logs.

<group name="web,">
    <rule id="100590" level="8">
        <decoded>
            <url>request_uri=</url>
        </decoded>
        <regex>\/oauth2\/authorize.*request_uri=.*redirect_uri=https?:\/\/</regex>
        <description>CVE-2026-59355: Spring Authorization Server open redirect attempt detected</description>
        <group>cve-2026-59355,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). Treat the patch as unverified until Broadcom/Spring releases an official advisory.

1. Immediate Mitigations (no patch available):

   • Restrict access to the authorization endpoint at the network layer (WAF rules) to block requests containing both request_uri and redirect_uri parameters where redirect_uri points to an external domain.
   • If possible, disable the request_uri parameter entirely via configuration, or reject any request containing it.
   • Monitor web server logs for abnormal authorization request patterns.

2. Patch/Upgrade Steps:

   • Watch for an official Spring Security / Spring Authorization Server advisory. The claimed patch version is expected to be 1.5.8 or 1.6.x.
   • Given the 2/4 confidence level, verify the patch's existence by testing the specific authorization request pattern against a staging instance before deploying.
   • Upgrade Spring Authorization Server to the patched version once confirmed, following standard Spring Boot dependency management (e.g., updating the spring-authorization-server artifact version).

3. Long-term Hardening:

   • Enforce strict redirect_uri validation at the client registration level: register all legitimate redirect URIs and configure the authorization server to reject unknown URIs even when request_uri is malformed.
   • Implement defense-in-depth with a Web Application Firewall (WAF) rule that blocks external redirect patterns.
   • Conduct regular code reviews and dependency scans for the Spring Authorization Server library.
   • If feasible, replace request_uri with JAR (JWT-secured Authorization Request) objects which carry their own validation.

References

1. NVD Entry — CVE-2026-59355
2. Spring Authorization Server — Project Page (official vendor documentation; patch advisory pending)
3. CWE-601: URL Redirection to Untrusted Site
4. MITRE ATT&CK — T1190: Exploit Public-Facing Application
5. CISA KEV Catalog — CVE-2026-59355 is not listed (no known exploitation in the wild as of this report)

Threat actor campaigns: No threat actor campaign or exploit-in-the-wild evidence has been associated with CVE-2026-59355 at the time of this report. The absence from the CISA KEV catalog and the lack of public PoCs indicate a low immediate exploitation priority, though the vulnerability remains a viable phishing vector.