CVE-2026-41706

About vulnerability

Spring Security’s CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL (including scheme, host, and port) is stored in the cookie and is used without validation as the post-login redirect target.

An application can be vulnerable when all the following conditions are met:

• The application uses CookieRequestCache (Servlet) or CookieServerRequestCache (WebFlux) as its RequestCache implementation.
• An attacker is able to influence the value of the REDIRECT_URI cookie, for example through cookie injection via a related subdomain, an HTTP response splitting attack, or a protocol downgrade from HTTPS to HTTP.

When all the conditions above are met, an attacker may be able to cause an authenticated user to be redirected to an attacker-controlled URL immediately after a successful login, enabling phishing attacks.

Affected product:

Apache CXF , Apache Log4j , Spring , camel , grails-core

Affected packages:

Spring Integration @ 5.5.19 (+4525 more)