CVE-2026-41694
SAML Payloads Decrypted Without Valid Signature
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
SAML Payloads Decrypted Without Valid Signature
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
- Record
CVE-2026-41694- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
EUVDEUVD-2026-35889
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
- Record
EUVD-2026-35889- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-ww38-37g9-m3q3
Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
- Record
GHSA-ww38-37g9-m3q3- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
NVD
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
- Record
CVE-2026-41694- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSV
SAML Payloads Decrypted Without Valid Signature
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
- Record
CVE-2026-41694- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
OSVGHSA-ww38-37g9-m3q3
Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.
Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
- Record
GHSA-ww38-37g9-m3q3- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-347
- Updated
- 2026-11-02
Show 22 moreShow less
OSVRHLW-2026-2cf5e53d95861e97
Lightwell Security Advisory: spring-security-saml2-service-provider 5.7.11.rhlw-00006
Red Hat Lightwell has released org.springframework.security:spring-security-saml2-service-provider 5.7.11.rhlw-00006 with backported fixes for CVE-2026-40988, CVE-2026-41003, and CVE-2026-41694.
CVE-2026-40988: Unbounded DEFLATE Inflation in SAML 2.0 Service Provider
CVE-2026-41003: Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
CVE-2026-41694: SAML Payloads Decrypted Without Valid Signature
This patched artifact is a drop-in replacement for org.springframework.security:spring-security-saml2-service-provider 5.7.11 from Maven Central.
- Record
RHLW-2026-2cf5e53d95861e97- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1783386141 No score
TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 5.7.11-tuxcare.4.
- Record
CLSA-2026-1783386141- Updated
- 2026-11-02
OSVCLSA-2026-1784682903 No score
TuxCare security update for org.springframework.security:spring-security-saml2-service-provider (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-saml2-service-provider to address 1 CVE. Fixed in 6.3.10-tuxcare.12.
- Record
CLSA-2026-1784682903- Updated
- 2026-11-02
OSVCLSA-2026-1784682907 No score
TuxCare security update for org.springframework.security:spring-security-saml2-service-provider (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-saml2-service-provider to address 1 CVE. Fixed in 6.4.3-tuxcare.6.
- Record
CLSA-2026-1784682907- Updated
- 2026-11-02
OSVCLSA-2026-1785727931 No score
TuxCare security update for org.springframework.security:spring-security-saml2-service-provider (3 CVEs)
TuxCare rebuilt org.springframework.security:spring-security-saml2-service-provider to address 3 CVEs. Fixed in 5.7.12-tuxcare.6.
- Record
CLSA-2026-1785727931- Updated
- 2026-11-02
OSVCLSA-2026-1785965552 No score
TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 5.7.14-tuxcare.4.
- Record
CLSA-2026-1785965552- Updated
- 2026-11-02
OSVCLSA-2026-1786479067 No score
TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 5.6.10-tuxcare.7.
- Record
CLSA-2026-1786479067- Updated
- 2026-11-02
OSVCLSA-2026-1786541618 No score
TuxCare security update for org.springframework.security:spring-security-saml2-service-provider (1 CVE)
TuxCare rebuilt org.springframework.security:spring-security-saml2-service-provider to address 1 CVE. Fixed in 5.8.16-tuxcare.14.
- Record
CLSA-2026-1786541618- Updated
- 2026-11-02
OSVCLSA-2026-1787145440 No score
TuxCare security update for org.springframework.security (4 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 4 CVEs. Fixed in 6.2.8-tuxcare.3.
- Record
CLSA-2026-1787145440- Updated
- 2026-11-02
OSVCLSA-2026-1787157249 No score
TuxCare security update for org.springframework.security (6 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 6 CVEs. Fixed in 6.4.13-tuxcare.2.
- Record
CLSA-2026-1787157249- Updated
- 2026-11-02
OSVCLSA-2026-1787323603 No score
TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.2-tuxcare.4.
- Record
CLSA-2026-1787323603- Updated
- 2026-11-02
OSVCLSA-2026-1787323624 No score
TuxCare security update for org.springframework.security (3 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 3 CVEs. Fixed in 6.2.7-tuxcare.4.
- Record
CLSA-2026-1787323624- Updated
- 2026-11-02
OSVCLSA-2026-1787649513 No score
TuxCare security update for org.springframework.security (2 CVEs)
TuxCare rebuilt 2 org.springframework.security packages to address 2 CVEs. Fixed in 6.0.8-tuxcare.2.
- Record
CLSA-2026-1787649513- Updated
- 2026-11-02
OSVCLSA-2026-1788340467 No score
TuxCare security update for org.springframework.security:spring-security-saml2-service-provider (2 CVEs)
TuxCare rebuilt org.springframework.security:spring-security-saml2-service-provider to address 2 CVEs. Fixed in 6.1.6-tuxcare.6.
- Record
CLSA-2026-1788340467- Updated
- 2026-11-02
OSVCLSA-2026-1789676383 No score
TuxCare security update for org.springframework.security (8 CVEs)
TuxCare rebuilt 3 org.springframework.security packages to address 8 CVEs. Fixed in 5.8.14-tuxcare.1.
- Record
CLSA-2026-1789676383- Updated
- 2026-11-02
OSVCLSA-2026-1790159292 No score
TuxCare security update for org.springframework.security (9 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 9 CVEs. Fixed in 6.3.9-tuxcare.1.
- Record
CLSA-2026-1790159292- Updated
- 2026-11-02
OSVCLSA-2026-1791380003 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.7.7-tuxcare.1.
- Record
CLSA-2026-1791380003- Updated
- 2026-11-02
OSVCLSA-2026-1791391633 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 11 CVEs. Fixed in 5.5.8-tuxcare.1.
- Record
CLSA-2026-1791391633- Updated
- 2026-11-02
OSVCLSA-2026-1791392813 No score
TuxCare security update for org.springframework.security (10 CVEs)
TuxCare rebuilt 4 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.9-tuxcare.1.
- Record
CLSA-2026-1791392813- Updated
- 2026-11-02
OSVCLSA-2026-1792079446 No score
TuxCare security update for org.springframework.security (15 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 15 CVEs. Fixed in 6.0.7-tuxcare.1.
- Record
CLSA-2026-1792079446- Updated
- 2026-11-02
OSVCLSA-2026-1792084952 No score
TuxCare security update for org.springframework.security (11 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 11 CVEs. Fixed in 5.8.15-tuxcare.2.
- Record
CLSA-2026-1792084952- Updated
- 2026-11-02
OSVCLSA-2026-1792089227 No score
TuxCare security update for org.springframework.security (10 CVEs)
TuxCare rebuilt 5 org.springframework.security packages to address 10 CVEs. Fixed in 5.6.7-tuxcare.1.
- Record
CLSA-2026-1792089227- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-saml2-service-providerMaven |
7.0.0 to 7.0.5 | 7.0.6 |
org.springframework.security:spring-security-saml2-service-providerMaven |
6.5.0 to 6.5.10 | 6.5.11 |
org.springframework.security:spring-security-saml2-service-providerMaven |
6.4.0 to 6.4.16 | None known |
org.springframework.security:spring-security-saml2-service-providerMaven |
6.3.0 to 6.3.16 | None known |
org.springframework.security:spring-security-saml2-service-providerMaven |
5.8.0 to 5.8.25 | None known |
org.springframework.security:spring-security-saml2-service-providerMaven |
through 5.7.23 | None known |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 4 CVEs |
5.7.11 up to 5.7.11-tuxcare.4, plus listed versions 5.7.11-tuxcare.15.7.11-tuxcare.25.7.11-tuxcare.35.7.11.tuxcare |
5.7.11-tuxcare.4 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 4 CVEs |
5.7.11 up to 5.7.11-tuxcare.4, plus listed versions 5.7.11-tuxcare.15.7.11-tuxcare.25.7.11-tuxcare.35.7.11.tuxcare |
5.7.11-tuxcare.4 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
6.3.10 up to 6.3.10-tuxcare.12, plus listed versions 6.3.10-tuxcare.16.3.10-tuxcare.106.3.10-tuxcare.116.3.10-tuxcare.26.3.10-tuxcare.3 Show 6 moreShow less6.3.10-tuxcare.46.3.10-tuxcare.56.3.10-tuxcare.66.3.10-tuxcare.76.3.10-tuxcare.86.3.10-tuxcare.9 |
6.3.10-tuxcare.12 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
6.4.3 up to 6.4.3-tuxcare.6, plus listed versions 6.4.3-tuxcare.16.4.3-tuxcare.26.4.3-tuxcare.36.4.3-tuxcare.46.4.3-tuxcare.5 |
6.4.3-tuxcare.6 |
Show 60 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 3 CVEs |
5.7.12 up to 5.7.12-tuxcare.6, plus listed versions 5.7.12-tuxcare.15.7.12-tuxcare.25.7.12-tuxcare.35.7.12-tuxcare.45.7.12-tuxcare.5 |
5.7.12-tuxcare.6 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 4 CVEs |
5.7.14 up to 5.7.14-tuxcare.4, plus listed versions 5.7.14-tuxcare.15.7.14-tuxcare.25.7.14-tuxcare.3 |
5.7.14-tuxcare.4 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 4 CVEs |
5.7.14 up to 5.7.14-tuxcare.4, plus listed versions 5.7.14-tuxcare.15.7.14-tuxcare.25.7.14-tuxcare.3 |
5.7.14-tuxcare.4 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 4 CVEs |
5.6.10 up to 5.6.10-tuxcare.7, plus listed versions 5.6.10-tuxcare.15.6.10-tuxcare.25.6.10-tuxcare.35.6.10-tuxcare.45.6.10-tuxcare.55.6.10-tuxcare.6 |
5.6.10-tuxcare.7 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 4 CVEs |
5.6.10 up to 5.6.10-tuxcare.7, plus listed versions 5.6.10-tuxcare.15.6.10-tuxcare.25.6.10-tuxcare.35.6.10-tuxcare.45.6.10-tuxcare.55.6.10-tuxcare.6 |
5.6.10-tuxcare.7 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven |
5.8.16 up to 5.8.16-tuxcare.14, plus listed versions 5.8.16-tuxcare.105.8.16-tuxcare.115.8.16-tuxcare.125.8.16-tuxcare.135.8.16-tuxcare.4 Show 9 moreShow less5.8.16-tuxcare.55.8.16-tuxcare.65.8.16-tuxcare.75.8.16-tuxcare.85.8.16-tuxcare.95.8.16.tuxcare5.8.16.tuxcare.15.8.16.tuxcare.25.8.16.tuxcare.3 |
5.8.16-tuxcare.14 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 4 CVEs |
6.2.8 up to 6.2.8-tuxcare.3, plus listed versions 6.2.8-tuxcare.16.2.8-tuxcare.2 |
6.2.8-tuxcare.3 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 4 CVEs |
6.2.8 up to 6.2.8-tuxcare.3, plus listed versions 6.2.8-tuxcare.16.2.8-tuxcare.2 |
6.2.8-tuxcare.3 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 6 CVEs |
6.4.13 up to 6.4.13-tuxcare.2, plus listed versions 6.4.13-tuxcare.1 |
6.4.13-tuxcare.2 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 3 CVEs |
6.2.2 up to 6.2.2-tuxcare.4, plus listed versions 6.2.2-tuxcare.16.2.2-tuxcare.26.2.2-tuxcare.3 |
6.2.2-tuxcare.4 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 3 CVEs |
6.2.2 up to 6.2.2-tuxcare.4, plus listed versions 6.2.2-tuxcare.16.2.2-tuxcare.26.2.2-tuxcare.3 |
6.2.2-tuxcare.4 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 3 CVEs |
6.2.7 up to 6.2.7-tuxcare.4, plus listed versions 6.2.7-tuxcare.16.2.7-tuxcare.26.2.7-tuxcare.3 |
6.2.7-tuxcare.4 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 3 CVEs |
6.2.7 up to 6.2.7-tuxcare.4, plus listed versions 6.2.7-tuxcare.16.2.7-tuxcare.26.2.7-tuxcare.3 |
6.2.7-tuxcare.4 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 2 CVEs |
6.0.8 up to 6.0.8-tuxcare.2, plus listed versions 6.0.8-tuxcare.1 |
6.0.8-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 2 CVEs |
6.0.8 up to 6.0.8-tuxcare.2, plus listed versions 6.0.8-tuxcare.1 |
6.0.8-tuxcare.2 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 2 CVEs |
6.1.6 up to 6.1.6-tuxcare.6, plus listed versions 6.1.6-tuxcare.16.1.6-tuxcare.26.1.6-tuxcare.36.1.6-tuxcare.46.1.6-tuxcare.5 |
6.1.6-tuxcare.6 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 8 CVEs |
5.8.14 up to 5.8.14-tuxcare.1 | 5.8.14-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 8 CVEs |
5.8.14 up to 5.8.14-tuxcare.1 | 5.8.14-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 8 CVEs |
5.8.14 up to 5.8.14-tuxcare.1 | 5.8.14-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-oauth2-joseTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 9 CVEs |
6.3.9 up to 6.3.9-tuxcare.1 | 6.3.9-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 11 CVEs |
5.7.7 up to 5.7.7-tuxcare.1 | 5.7.7-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 11 CVEs |
5.5.8 up to 5.5.8-tuxcare.1 | 5.5.8-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 10 CVEs |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 10 CVEs |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 10 CVEs |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 10 CVEs |
5.6.9 up to 5.6.9-tuxcare.1 | 5.6.9-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 15 CVEs |
6.0.7 up to 6.0.7-tuxcare.1 | 6.0.7-tuxcare.1 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 11 CVEs |
5.8.15 up to 5.8.15-tuxcare.2, plus listed versions 5.8.15.tuxcare5.8.15.tuxcare.1 |
5.8.15-tuxcare.2 |
org.springframework.security:spring-security-coreTuxCare:Maven From an advisory covering 10 CVEs |
5.6.7 up to 5.6.7-tuxcare.1 | 5.6.7-tuxcare.1 |
org.springframework.security:spring-security-cryptoTuxCare:Maven From an advisory covering 10 CVEs |
5.6.7 up to 5.6.7-tuxcare.1 | 5.6.7-tuxcare.1 |
org.springframework.security:spring-security-ldapTuxCare:Maven From an advisory covering 10 CVEs |
5.6.7 up to 5.6.7-tuxcare.1 | 5.6.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerTuxCare:Maven From an advisory covering 10 CVEs |
5.6.7 up to 5.6.7-tuxcare.1 | 5.6.7-tuxcare.1 |
org.springframework.security:spring-security-webTuxCare:Maven From an advisory covering 10 CVEs |
5.6.7 up to 5.6.7-tuxcare.1 | 5.6.7-tuxcare.1 |
org.springframework.security:spring-security-saml2-service-providerMaven |
7.0.0 up to 7.0.6, plus listed versions 7.0.17.0.27.0.37.0.47.0.5 |
7.0.6 |
org.springframework.security:spring-security-saml2-service-providerMaven |
6.5.0 up to 6.5.11, plus listed versions 6.5.16.5.106.5.26.5.36.5.4 Show 5 moreShow less6.5.56.5.66.5.76.5.86.5.9 |
6.5.11 |
org.springframework.security:spring-security-saml2-service-providerMaven |
6.4.0 to 6.4.16, plus listed versions 6.4.16.4.106.4.116.4.126.4.13 Show 8 moreShow less6.4.26.4.36.4.46.4.56.4.66.4.76.4.86.4.9 |
None known |
org.springframework.security:spring-security-saml2-service-providerMaven |
6.3.0 to 6.3.16, plus listed versions 6.3.16.3.106.3.26.3.36.3.4 Show 5 moreShow less6.3.56.3.66.3.76.3.86.3.9 |
None known |
org.springframework.security:spring-security-saml2-service-providerMaven |
5.8.0 to 5.8.25, plus listed versions 5.8.15.8.105.8.115.8.125.8.13 Show 11 moreShow less5.8.145.8.155.8.165.8.25.8.35.8.45.8.55.8.65.8.75.8.85.8.9 |
None known |
org.springframework.security:spring-security-saml2-service-providerMaven |
through 5.7.23, plus listed versions 5.2.0.RELEASE5.2.1.RELEASE5.2.10.RELEASE5.2.11.RELEASE5.2.12.RELEASE Show 45 moreShow less5.2.13.RELEASE5.2.14.RELEASE5.2.15.RELEASE5.2.2.RELEASE5.2.3.RELEASE5.2.4.RELEASE5.2.5.RELEASE5.2.6.RELEASE5.2.7.RELEASE5.2.8.RELEASE5.2.9.RELEASE5.3.0.RELEASE5.3.1.RELEASE5.3.10.RELEASE5.3.11.RELEASE5.3.12.RELEASE5.3.13.RELEASE5.3.2.RELEASE5.3.3.RELEASE5.3.4.RELEASE5.3.5.RELEASE5.3.6.RELEASE5.3.7.RELEASE5.3.8.RELEASE5.3.9.RELEASE5.4.05.4.15.4.105.4.115.4.25.4.35.4.45.4.55.4.65.4.75.4.85.4.95.5.05.5.15.5.25.5.35.5.45.5.55.5.65.5.7 |
None known |
org.springframework.security:spring-security-saml2-service-providerRed Hat Lightwell:Maven From an advisory covering 3 CVEs |
before 5.7.11.rhlw-00006, plus listed versions 5.2.0.RELEASE5.2.1.RELEASE5.2.10.RELEASE5.2.11.RELEASE5.2.12.RELEASE Show 45 moreShow less5.2.13.RELEASE5.2.14.RELEASE5.2.15.RELEASE5.2.2.RELEASE5.2.3.RELEASE5.2.4.RELEASE5.2.5.RELEASE5.2.6.RELEASE5.2.7.RELEASE5.2.8.RELEASE5.2.9.RELEASE5.3.0.RELEASE5.3.1.RELEASE5.3.10.RELEASE5.3.11.RELEASE5.3.12.RELEASE5.3.13.RELEASE5.3.2.RELEASE5.3.3.RELEASE5.3.4.RELEASE5.3.5.RELEASE5.3.6.RELEASE5.3.7.RELEASE5.3.8.RELEASE5.3.9.RELEASE5.4.05.4.15.4.105.4.115.4.25.4.35.4.45.4.55.4.65.4.75.4.85.4.95.5.05.5.15.5.25.5.35.5.45.5.55.5.65.5.7 |
5.7.11.rhlw-00006 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, affected_more | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-41694 is a low vulnerability (CVSS 3.7) in Spring Security, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in org.springframework.security:spring-security-saml2-service-provider 7.0.6.
References
spring.io/security/cve-2026-41694
nvd.nist.gov/vuln/detail/CVE-2026-41694
github.com/spring-projects/spring-security/releases/tag/6.5.11
Show 9 moreShow less
Left out here: 55 versions. The JSON record has them.