CVE-2026-41694

MediumCVSS 5.3/10Last modified Jul 23, 2026

Description

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.

Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
Spring	Spring Security	>= 5.7.0, < 5.7.24; >= 5.8.0, < 5.8.26; >= 6.3.0, < 6.3.17; >= 6.4.0, < 6.4.17; >= 6.5.0, < 6.5.10.2; >= 7.0.0, < 7.0.5.1

References

https://spring.io/security/cve-2026-41694Vendor Advisory

Timeline

Published: Jun 10, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-416957.5Spring Data Commons applications may be vulnerable to denial of service through resource exhaustion when attacker-controlled property path s CVE-2026-416965.9Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the b CVE-2026-416974.8Spring Data Relational does not properly escape binding values of externally-controlled input when using StringMatcher (STARTING, ENDING, or CVE-2026-416999.8Spring for GraphQL applications are vulnerable to Unsafe Deserialization when processing paginated GraphQL queries. An attacker can craft a CVE-2026-41709.8A weakness has been identified in Topsec TopACM 3.0. Affected by this vulnerability is an unknown functionality of the file /view/systemConf CVE-2026-417008.1Spring for GraphQL applications that have enabled the WebSocket transport are vulnerable to Cross-Site WebSocket Hijacking. An attacker can CVE-2026-417014.4Correlation IDs for replies in the RabbitTemplate.sendAndReceive() with the fixed reply queue are predictable due to internal simple counter CVE-2026-417027.0VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A ma CVE-2026-417037.6VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigg CVE-2026-417045.0AgentClient#handle_method (lines 264-303) processes every NATS reply. It calls inject_compile_log (line 273) on every response, which reads CVE-2026-417058.6Spring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. Sprin CVE-2026-417066.1Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users