CVE-2026-41694: spring spring security
Vulnerability summary
CVE-2026-41694 is a medium (CVSS 5.3) vulnerability in spring spring security. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.1% of scored vulnerabilities.
Timeline
- 09-06-2026PublishedVulnerability first disclosed.
- 27-06-2026Last modifiedVulnerability information updated.
Description
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
- OSV · MavenEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.18%
Chance of exploitation in the next 30 days
Percentile
7%
Versus all other CVEs
30-day change
+0.03 pp
From 0.15% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Org.springframework.security1 product
- spring-security-saml2-service-provider≥ 7.0.0, < 7.0.6 | ≥ 6.5.0, < 6.5.11 | ≥ 6.4.0, ≤ 6.4.16 | ≥ 6.3.0, ≤ 6.3.16 | ≥ 5.8.0, ≤ 5.8.25 | ≤ 5.7.23
Spring1 product
- spring security≥ 5.7.0, < 5.7.24 | ≥ 5.8.0, < 5.8.26 | ≥ 6.3.0, < 6.3.17 | ≥ 6.4.0, < 6.4.17 | ≥ 6.5.0, < 6.5.10.2 | ≥ 7.0.0, < 7.0.5.1
Vmware1 product
- spring_security≥ 5.7.0, < 5.7.24 | ≥ 5.8.0, < 5.8.26 | ≥ 6.3.0, < 6.3.17 | ≥ 6.4.0, < 6.4.17 | ≥ 6.5.0, < 6.5.10.2 | ≥ 7.0.0, < 7.0.5.1
3 vendors · 3 products
