GHSA-x2r2-rvhq-2mqv

Source

https://github.com/advisories/GHSA-x2r2-rvhq-2mqv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x2r2-rvhq-2mqv/GHSA-x2r2-rvhq-2mqv.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-x2r2-rvhq-2mqv

Aliases

CVE-2026-41706

Downstream

CGA (24)

MINI (8)

Published

2026-06-10T00:31:51Z

Modified

2026-08-12T16:41:13Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache

Details

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is used without validation as the post-login redirect target.

Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

Database specific

{
    "cwe_ids": [
        "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-12T16:17:14Z",
    "nvd_published_at": "2026-06-10T00:16:51Z",
    "severity": "MODERATE"
}

References

Affected packages

Maven

org.springframework.security:spring-security-web

Package

Name: org.springframework.security:spring-security-web; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

7.0.6

Affected versions

7.*

7.0.0

7.0.1

7.0.2

7.0.3

7.0.4

7.0.5

Database specific

last_known_affected_version_range

"<= 7.0.5"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x2r2-rvhq-2mqv/GHSA-x2r2-rvhq-2mqv.json"

org.springframework.security:spring-security-web

Package

Name: org.springframework.security:spring-security-web; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.5.0

Fixed

6.5.11

Affected versions

6.*

6.5.0

6.5.1

6.5.2

6.5.3

6.5.4

6.5.5

6.5.6

6.5.7

6.5.8

6.5.9

6.5.10

Database specific

last_known_affected_version_range

"<= 6.5.10"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x2r2-rvhq-2mqv/GHSA-x2r2-rvhq-2mqv.json"

org.springframework.security:spring-security-web

Package

Name: org.springframework.security:spring-security-web; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.3.0

Last Affected

6.3.16

Affected versions

6.*

6.3.0

6.3.1

6.3.2

6.3.3

6.3.4

6.3.5

6.3.6

6.3.7

6.3.8

6.3.9

6.3.10

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x2r2-rvhq-2mqv/GHSA-x2r2-rvhq-2mqv.json"

org.springframework.security:spring-security-web

Package

Name: org.springframework.security:spring-security-web; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.8.0

Last Affected

5.8.25

Affected versions

5.*

5.8.0

5.8.1

5.8.2

5.8.3

5.8.4

5.8.5

5.8.6

5.8.7

5.8.8

5.8.9

5.8.10

5.8.11

5.8.12

5.8.13

5.8.14

5.8.15

5.8.16

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x2r2-rvhq-2mqv/GHSA-x2r2-rvhq-2mqv.json"

org.springframework.security:spring-security-web

Package

Name: org.springframework.security:spring-security-web; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-web

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

5.7.23

Affected versions

3.*

3.0.0.RELEASE

3.0.1.RELEASE

3.0.2.RELEASE

3.0.3.RELEASE

3.0.4.RELEASE

3.0.5.RELEASE

3.0.6.RELEASE

3.0.7.RELEASE

3.0.8.RELEASE

3.1.0.RELEASE

3.1.1.RELEASE

3.1.2.RELEASE

3.1.3.RELEASE

3.1.4.RELEASE

3.1.5.RELEASE

3.1.6.RELEASE

3.1.7.RELEASE

3.2.0.RELEASE

3.2.1.RELEASE

3.2.2.RELEASE

3.2.3.RELEASE

3.2.4.RELEASE

3.2.5.RELEASE

3.2.6.RELEASE

3.2.7.RELEASE

3.2.8.RELEASE

3.2.9.RELEASE

3.2.10.RELEASE

4.*

4.0.0.RELEASE

4.0.1.RELEASE

4.0.2.RELEASE

4.0.3.RELEASE

4.0.4.RELEASE

4.1.0.RELEASE

4.1.1.RELEASE

4.1.2.RELEASE

4.1.3.RELEASE

4.1.4.RELEASE

4.1.5.RELEASE

4.2.0.RELEASE

4.2.1.RELEASE

4.2.2.RELEASE

4.2.3.RELEASE

4.2.4.RELEASE

4.2.5.RELEASE

4.2.6.RELEASE

4.2.7.RELEASE

4.2.8.RELEASE

4.2.9.RELEASE

4.2.10.RELEASE

4.2.11.RELEASE

4.2.12.RELEASE

4.2.13.RELEASE

4.2.14.RELEASE

4.2.15.RELEASE

4.2.16.RELEASE

4.2.17.RELEASE

4.2.18.RELEASE

4.2.19.RELEASE

4.2.20.RELEASE

5.*

5.0.0.RELEASE

5.0.1.RELEASE

5.0.2.RELEASE

5.0.3.RELEASE

5.0.4.RELEASE

5.0.5.RELEASE

5.0.6.RELEASE

5.0.7.RELEASE

5.0.8.RELEASE

5.0.9.RELEASE

5.0.10.RELEASE

5.0.11.RELEASE

5.0.12.RELEASE

5.0.13.RELEASE

5.0.14.RELEASE

5.0.15.RELEASE

5.0.16.RELEASE

5.0.17.RELEASE

5.0.18.RELEASE

5.0.19.RELEASE

5.1.0.RELEASE

5.1.1.RELEASE

5.1.2.RELEASE

5.1.3.RELEASE

5.1.4.RELEASE

5.1.5.RELEASE

5.1.6.RELEASE

5.1.7.RELEASE

5.1.8.RELEASE

5.1.9.RELEASE

5.1.10.RELEASE

5.1.11.RELEASE

5.1.12.RELEASE

5.1.13.RELEASE

5.2.0.RELEASE

5.2.1.RELEASE

5.2.2.RELEASE

5.2.3.RELEASE

5.2.4.RELEASE

5.2.5.RELEASE

5.2.6.RELEASE

5.2.7.RELEASE

5.2.8.RELEASE

5.2.9.RELEASE

5.2.10.RELEASE

5.2.11.RELEASE

5.2.12.RELEASE

5.2.13.RELEASE

5.2.14.RELEASE

5.2.15.RELEASE

5.3.0.RELEASE

5.3.1.RELEASE

5.3.2.RELEASE

5.3.3.RELEASE

5.3.4.RELEASE

5.3.5.RELEASE

5.3.6.RELEASE

5.3.7.RELEASE

5.3.8.RELEASE

5.3.9.RELEASE

5.3.10.RELEASE

5.3.11.RELEASE

5.3.12.RELEASE

5.3.13.RELEASE

5.4.0

5.4.1

5.4.2

5.4.3

5.4.4

5.4.5

5.4.6

5.4.7

5.4.8

5.4.9

5.4.10

5.4.11

5.5.0

5.5.1

5.5.2

5.5.3

5.5.4

5.5.5

5.5.6

5.5.7

5.5.8

5.6.0

5.6.1

5.6.2

5.6.3

5.6.4

5.6.5

5.6.6

5.6.7

5.6.8

5.6.9

5.6.10

5.6.11

5.6.12

5.7.0

5.7.1

5.7.2

5.7.3

5.7.4

5.7.5

5.7.6

5.7.7

5.7.8

5.7.9

5.7.10

5.7.11

5.7.12

5.7.13

5.7.14

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-x2r2-rvhq-2mqv/GHSA-x2r2-rvhq-2mqv.json"