CVE-2026-40993
Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).
Affected versions: Spring Security 7.0.0 through 7.0.5.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- High
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).
Affected versions: Spring Security 7.0.0 through 7.0.5.
- Record
CVE-2026-40993- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
EUVDEUVD-2026-35886
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).
Affected versions: Spring Security 7.0.0 through 7.0.5.
- Record
EUVD-2026-35886- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2q7c-5gjm-7q23
Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepository
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).
Affected versions: Spring Security 7.0.0 through 7.0.5.
- Record
GHSA-2q7c-5gjm-7q23- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
NVD
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).
Affected versions: Spring Security 7.0.0 through 7.0.5.
- Record
CVE-2026-40993- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H - CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).
Affected versions: Spring Security 7.0.0 through 7.0.5.
- Record
CVE-2026-40993- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVGHSA-2q7c-5gjm-7q23
Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepository
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).
Affected versions: Spring Security 7.0.0 through 7.0.5.
- Record
GHSA-2q7c-5gjm-7q23- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-40993 No score
CVE-2026-40993 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root
Root has patched CVE-2026-40993 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-40993- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-saml2-service-providerMaven |
7.0.0 to 7.0.5 | 7.0.6 |
org.springframework.security:spring-security-saml2-service-providerMaven |
7.0.0 up to 7.0.6, plus listed versions 7.0.17.0.27.0.37.0.47.0.5 |
7.0.6 |
org.springframework.security:spring-security-saml2-service-providerRoot:Maven |
before 7.0.4-aikido.1 | 7.0.4-aikido.1 |
io.root.org.springframework.security:spring-security-saml2-service-providerRoot:Maven |
before 7.0.4-root.io.1 | 7.0.4-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40993 is a high vulnerability (CVSS 7.3) in Spring Security, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 9th percentile. Fixed in org.springframework.security:spring-security-saml2-service-provider 7.0.6.