CVE-2026-11477

MediumCVSS 4.3

Published: 08/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

23th percentile - higher than 23% of all known CVEs

Summary

hsweb-framework up to version 5.0.1 contains an open redirect vulnerability in the OAuth2Client function in OAuth2Client.java. An attacker can remotely exploit this to redirect users to an external malicious site.

Risk Assessment

An attacker can use the open redirect for phishing or credential theft by redirecting users to a malicious site.

Recommendation

Apply the patch identified as c2882679a9125cea52678151af5ae213cbd52579 or upgrade to a newer version.

Other vulnerabilities in hsweb-framework

CVE-2026-11470Medium
hsweb-framework up to version 5.0.1 contains a path traversal vulnerability in the denied function in FileUploadProperties.java. An attacker can remotely manipulate the filename argument to access files outside the intended directory.

Original NVD description (English source)

A vulnerability was detected in hs-web hsweb-framework up to 5.0.1. This affects the function OAuth2Client of the file hsweb-authorization/hsweb-authorization-oauth2/src/main/java/org/hswebframework/web/oauth2/server/OAuth2Client.java of the component OAuth2 Client. The manipulation results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as c2882679a9125cea52678151af5ae213cbd52579. Applying a patch is advised to resolve this issue.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS