Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕ Maven

CVE-2019-3778

MEDIUM

CVE-2019-3778 is a medium-severity (CVSS 6.5) Open Redirect vulnerability in org.springframework.security.oauth:spring-security-oauth. 1 public exploit reference exists, so weaponization risk is real. O3 Security confirms whether CVE-2019-3778 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.

spring-security-oauth and spring-security-oauth2 Open Redirect vulnerability

Also known asGHSA-77rv-6vfw-x4gc
Published
Mar 7, 2019
Updated
Apr 10, 2026
Affected
8 pkgs
Patched
8 / 8
Exploits
1 known

Blast Radius

8 pkgs affected
☕org.springframework.security.oauth:spring-security-oauth☕org.springframework.security.oauth:spring-security-oauth2☕org.springframework.security.oauth:spring-security-oauth☕org.springframework.security.oauth:spring-security-oauth2☕org.springframework.security.oauth:spring-security-oauth☕org.springframework.security.oauth:spring-security-oauth2☕org.springframework.security.oauth:spring-security-oauth☕org.springframework.security.oauth:spring-security-oauth2

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).

Affected Packages

8 total 8 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.springframework.security.oauth:spring-security-oauthall versions2.0.17.RELEASE
☕Mavenorg.springframework.security.oauth:spring-security-oauth2all versions2.0.17.RELEASE
☕Mavenorg.springframework.security.oauth:spring-security-oauth≥ 2.1.0.RELEASE&&< 2.1.4.RELEASE2.1.4.RELEASE
☕Mavenorg.springframework.security.oauth:spring-security-oauth2≥ 2.1.0.RELEASE&&< 2.1.4.RELEASE2.1.4.RELEASE
☕Mavenorg.springframework.security.oauth:spring-security-oauth≥ 2.2.0.RELEASE&&< 2.2.4.RELEASE2.2.4.RELEASE
☕Mavenorg.springframework.security.oauth:spring-security-oauth2≥ 2.2.0.RELEASE&&< 2.2.4.RELEASE2.2.4.RELEASE
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

EDB-47000webappsjava

Spring Security OAuth - Open Redirector

by Riemann · Jun 17, 2019

Exploit-DB Source

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.springframework.security.oauth:spring-security-oauth. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.

  2. Fix

    Update org.springframework.security.oauth:spring-security-oauth to 2.0.17.RELEASE or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2019-3778 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

  4. How O3 protects you

    O3 pinpoints whether CVE-2019-3778 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.

Tailored to CVE-2019-3778. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.

Frequently Asked Questions

Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the "redirect_uri" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
O3 Security · Impact-Aware SCA

Is CVE-2019-3778 in your dependencies?

O3 detects CVE-2019-3778 across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my dependencies How O3 SCA works