Vulnerabilities

TI-2026-29659 CVE-2026-41008 · GHSA-4r8w-73jc-3m7q

Spring Security Authorization Server Open Redirect via request_uri

LOW 26

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the request_uri parameter.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0018 Published 2026-06-09 Fixed in 7.0.5.1, 1.5.7.1 +2 CWE-601

TI-2026-29644 CVE-2026-40993 · GHSA-2q7c-5gjm-7q23

Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry

LOW 31

An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the c…

CVSS 3.1HIGH 7.3 Adjacent network High privileges No interaction EPSS 0.00198 Published 2026-06-09 Fixed in 7.0.5.1, 7.0.6 CWE-502

Vulnerabilities

Filters

Spring Security Authorization Server Open Redirect via request_uri

Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry