AIKIDO-2026-11188
spring-security-web is vulnerable to Open Redirect
61
Medium Risk
This Affects:
spring-security-webTL;DR
Affected versions of Spring Security may allow an open redirect after login when CookieRequestCache or CookieServerRequestCache is used to persist the original request URL in a browser cookie. Because the absolute URL from the REDIRECT_URI cookie is reused without validation, an attacker who can tamper with that cookie may force the application to send the user to an attacker-controlled site after successful authentication. In practice, this could be exploited through cookie injection from a related subdomain, HTTP response splitting, or a downgrade from HTTPS to HTTP, enabling convincing phishing flows that abuse the trusted login process.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you are using CookieRequestCache (Servlet) or CookieServerRequestCache (WebFlux) as its RequestCache implementation.
Background info
spring-security-web is vulnerable to Open Redirect in versions 0.0.1 - 6.5.10 and 7.0.0 - 7.0.5.
How to fix this
Upgrade the org.springframework.security:spring-security-web library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.