CVE-2026-41003 — Vulnerability in...
Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters
Summary
Advisory Timeline
- First published June 10, 2026 (124 days ago).
- Last revised August 12, 2026 — 64 days after initial publication.
Remediation
Upgrade to the fixed version using your package manager.
<!-- Update pom.xml dependency version to 7.0.6 for org.springframework.security:spring-security-saml2-service-provider -->
<!-- Update pom.xml dependency version to 6.5.11 for org.springframework.security:spring-security-saml2-service-provider -->
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (6)
Affects 1 ecosystem: maven (1).
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| org.springframework.security:spring-security-saml2-service-provider | maven | 6.4.0, 6.4.1, 6.4.10, 6.4.11 (+10 more) | Range-based data available |
| org.springframework.security:spring-security-saml2-service-provider | maven | 5.2.0.RELEASE, 5.2.1.RELEASE, 5.2.10.RELEASE, 5.2.11.RELEASE (+75 more) | Range-based data available |
| org.springframework.security:spring-security-saml2-service-provider | maven | 5.8.0, 5.8.1, 5.8.10, 5.8.11 (+13 more) | Range-based data available |
| org.springframework.security:spring-security-saml2-service-provider | maven | 7.0.0, 7.0.1, 7.0.2, 7.0.3 (+2 more) | 7.0.6 |
| org.springframework.security:spring-security-saml2-service-provider | maven | 6.3.0, 6.3.1, 6.3.10, 6.3.2 (+7 more) | Range-based data available |
| org.springframework.security:spring-security-saml2-service-provider | maven | 6.5.0, 6.5.1, 6.5.10, 6.5.2 (+7 more) | 6.5.11 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-79Cross-site Scripting (XSS)MITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 7.6 score means for each attack dimension.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-41003ADVISORY
- https://github.com/spring-projects/spring-securityPACKAGE
- https://github.com/spring-projects/spring-security/releases/tag/6.5.11WEB
- https://github.com/spring-projects/spring-security/releases/tag/7.0.6WEB
- https://spring.io/security/cve-2026-41003WEB
Frequently Asked Questions
- What is CVE-2026-41003?
- Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.6/10).
- How do I check if my project is affected by CVE-2026-41003?
- CVE-2026-41003 affects org.springframework.security:spring-security-saml2-service-provider. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-41003 and 200,000+ other known vulnerabilities.
Severity & Exploitability
High exploitability or significant impact. Prioritize remediation within days.
Also Known As
Related CVEs
- CVE-2023-34034CRITICAL
Access Control Bypass in Spring Security
- CVE-2025-41232CRITICAL
Spring Security authorization bypass for method security annotations on private methods
- CVE-2024-38821CRITICAL
Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications
- CVE-2022-22978CRITICAL
Authorization bypass in Spring Security
- CVE-2026-22732CRITICAL
Spring Security HTTP Headers Are not Written Under Some Conditions
- CVE-2022-31692CRITICAL
Spring Security authorization rules can be bypassed via forward or include dispatcher types
- CVE-2018-1260CRITICAL
Spring Security OAuth vulnerable to remote code execution (RCE)
- CVE-2026-40988HIGH
Spring Security SAML2 Service Provider: Unbounded writer inflates the compressed SAML payload into memory (DoS)
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies