CVE-2026-81029: Java Servlet Sso Credential Bearing Redirect Without No Store
A redirect Location that embeds an issued credential (access/JWT token) and user identity is sent with a raw HttpServletResponse.sendRedirect(). In an SSO flow (OIDC/OAuth2/SAML) whose redirect target originates from a caller-supplied callback parameter (?redirectUri= / ?callback= / RelayState) and is only checked after the token is minted, the server delive
Javagreprules fetch cve-2026-81029-java-servlet-sso-credential-bearing-redirect-without-no-store --engine opengrepDescription
A redirect Location that embeds an issued credential (access/JWT token) and user identity is sent with a raw HttpServletResponse.sendRedirect(). In an SSO flow (OIDC/OAuth2/SAML) whose redirect target originates from a caller-supplied callback parameter (?redirectUri= / ?callback= / RelayState) and is only checked after the token is minted, the server delive
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.