CVE-2019-11269
Open Redirector in spring-security-oauth2
Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Open Redirector in spring-security-oauth2
Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
- Record
CVE-2019-11269- CVSS 3.0
- 4.2 Medium
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2019-0551
Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
- Record
EUVD-2019-0551- CVSS 3.0
- 4.2 Medium
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mmf6-6597-3v6m
Open Redirect in Spring Security OAuth
Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
- Record
GHSA-mmf6-6597-3v6m- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
- Record
CVE-2019-11269- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - CVSS 3.0
- 4.2 Medium
CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
- Record
CVE-2019-11269- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-mmf6-6597-3v6m
Open Redirect in Spring Security OAuth
Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
- Record
GHSA-mmf6-6597-3v6m- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security.oauth:spring-security-oauthMaven |
2.0.0.RELEASE up to 2.0.18.RELEASE | 2.0.18.RELEASE |
org.springframework.security.oauth:spring-security-oauthMaven |
2.1.0.RELEASE up to 2.1.5.RELEASE | 2.1.5.RELEASE |
org.springframework.security.oauth:spring-security-oauthMaven |
2.2.0.RELEASE up to 2.2.5.RELEASE | 2.2.5.RELEASE |
org.springframework.security.oauth:spring-security-oauthMaven |
2.3.0.RELEASE up to 2.3.6.RELEASE | 2.3.6.RELEASE |
org.springframework.security.oauth:spring-security-oauthMaven |
2.0.0.RELEASE up to 2.0.18.RELEASE, plus listed versions 2.0.1.RELEASE2.0.10.RELEASE2.0.11.RELEASE2.0.12.RELEASE2.0.13.RELEASE Show 12 moreShow less2.0.14.RELEASE2.0.15.RELEASE2.0.16.RELEASE2.0.17.RELEASE2.0.2.RELEASE2.0.3.RELEASE2.0.4.RELEASE2.0.5.RELEASE2.0.6.RELEASE2.0.7.RELEASE2.0.8.RELEASE2.0.9.RELEASE |
2.0.18.RELEASE |
org.springframework.security.oauth:spring-security-oauthMaven |
2.1.0.RELEASE up to 2.1.5.RELEASE, plus listed versions 2.1.1.RELEASE2.1.2.RELEASE2.1.3.RELEASE2.1.4.RELEASE |
2.1.5.RELEASE |
org.springframework.security.oauth:spring-security-oauthMaven |
2.2.0.RELEASE up to 2.2.5.RELEASE, plus listed versions 2.2.1.RELEASE2.2.2.RELEASE2.2.3.RELEASE2.2.4.RELEASE |
2.2.5.RELEASE |
org.springframework.security.oauth:spring-security-oauthMaven |
2.3.0.RELEASE up to 2.3.6.RELEASE, plus listed versions 2.3.1.RELEASE2.3.2.RELEASE2.3.3.RELEASE2.3.4.RELEASE2.3.5.RELEASE |
2.3.6.RELEASE |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Spring Security OAuth - Open Redirector | 2019-06-17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-11269 is a medium vulnerability (CVSS 4.2) in Pivotal Software Spring Security Oauth, published June 12, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.91%, the 95th percentile. Fixed in org.springframework.security.oauth:spring-security-oauth 2.0.18.RELEASE.