UrlHandlerFilter can be configured with very broadly matching patterns, enabling an attacker to trigger an open redirect that sends users to arbitrary external URLs. The vulnerability exists in both Spring MVC and Spring WebFlux implementations of the filter. An attacker can craft a specially tailored HTTP request that causes the application to redirect the user to a malicious site without requiring any authentication. The consequence is primarily phishing or credential theft, as users are led to sites that mimic the legitimate application.

This flaw affects Spring Framework versions 6.2.0 through 6.2.19 and 7.0.0 through 7.0.8. Applications built with Spring MVC or Spring WebFlux that incorporate UrlHandlerFilter and expose it to user input are potentially vulnerable when these library versions are in use.

The CVSS score of 6.1 indicates medium severity. The EPSS score of less than 1% suggests a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, an attacker can trigger the redirect remotely by calling the filter with an appropriately crafted URL. Because no authentication is required and the potential for social‑engineering attacks exists, the issue should be treated as a higher priority relative to other medium‑severity vulnerabilities.