UrlHandlerFilter can be compromised to perform an open redirect when configured with very broadly matching patterns. The vulnerability appears in both the Spring MVC and Spring WebFlux implementations of the filter. An attacker can send a specially crafted HTTP request that causes the application to redirect the user to an arbitrary external URL. The consequence is primarily phishing or credential theft, as the redirect can lead to malicious sites that mimic the legitimate application.

The flaw affects Spring Framework versions 6.2.0 through 6.2.19 and 7.0.0 through 7.0.8. These versions are used by Spring MVC and Spring WebFlux applications that employ UrlHandlerFilter without strictly limiting the patterns they accept. Any deployment using these library versions and exposing the filter to user input is potentially vulnerable.

No CVSS score is published, and the EPSS score is not available, so the quantitative risk estimate remains uncertain. The KEV catalog does not list this issue, indicating that there have been no confirmed exploitations yet. Nevertheless, the attack path does not require authentication; a remote attacker can trigger the redirect by calling the filter with an appropriate URL. Given the potential for social‑engineering attacks, administrators should treat the vulnerability as high priority relative to other medium‑severity issues.