{"id":"CVE-2026-40993","aliases":["EUVD-2026-35886","GHSA-2q7c-5gjm-7q23","ROOT-APP-MAVEN-CVE-2026-40993"],"status":"published","title":"Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry","description":"An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).\n\nAffected versions:\nSpring Security 7.0.0 through 7.0.5.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00198,"percentile":0.09588,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-502"],"published":"2026-06-09T23:46:39Z","modified":"2026-10-28T02:30:57Z","fixes":[{"ecosystem":"Maven","package":"org.springframework.security:spring-security-saml2-service-provider","fixed_in":["7.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","fixed_in":["7.0.4-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-saml2-service-provider","fixed_in":["7.0.4-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.5"},{"fixed":"7.0.6"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.6"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.3","7.0.4","7.0.5"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.springframework.security:spring-security-saml2-service-provider","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.4-root.io.1"}]}]}],"products":[{"vendor":"spring","product":"spring security"},{"vendor":"vmware","product":"spring_security"}],"references":[{"url":"https://spring.io/security/cve-2026-40993","tags":["Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40993","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-security/releases/tag/7.0.6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2q7c-5gjm-7q23"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40993.json","tags":["advisory"]},{"url":"https://github.com/spring-projects/spring-security","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-40993","title":"Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry","description":"An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).\n\nAffected versions:\nSpring Security 7.0.0 through 7.0.5.","status":"published","published":"2026-06-09T23:46:39.702Z","modified":"2026-06-27T21:23:25.462Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-35886","description":"An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).\n\nAffected versions:\nSpring Security 7.0.0 through 7.0.5.","status":"published","published":"2026-06-09T23:46:39Z","modified":"2026-06-27T21:23:25Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:23.349194Z"}],"ghsa":[{"id":"GHSA-2q7c-5gjm-7q23","title":"Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepository","description":"An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).\n\nAffected versions:\nSpring Security 7.0.0 through 7.0.5.","status":"published","published":"2026-06-10T00:31:51Z","modified":"2026-08-12T17:04:27Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:40:58.888637Z"}],"nvd":[{"id":"CVE-2026-40993","description":"An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).\n\nAffected versions:\nSpring Security 7.0.0 through 7.0.5.","status":"published","published":"2026-06-10T00:16:50.197Z","modified":"2026-07-23T09:10:00.113Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:23.485267Z"}],"osv":[{"id":"CVE-2026-40993","title":"Unfiltered Java Native Deserialization of SAML 2.0 Asserting Party Credentials BLOB Database Entry","description":"An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).\n\nAffected versions:\nSpring Security 7.0.0 through 7.0.5.","status":"published","published":"2026-06-09T23:46:39.702Z","modified":"2026-10-28T02:30:57.478315502Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:45:03.424067Z"},{"id":"GHSA-2q7c-5gjm-7q23","title":"Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepository","description":"An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).\n\nAffected versions:\nSpring Security 7.0.0 through 7.0.5.","status":"published","published":"2026-06-10T00:31:51Z","modified":"2026-08-12T17:26:04.322495Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-40993","title":"CVE-2026-40993 in org.springframework.security:spring-security-saml2-service-provider - Patched by Root","description":"Root has patched CVE-2026-40993 in the org.springframework.security:spring-security-saml2-service-provider package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-16T07:13:11Z","modified":"2026-09-16T08:15:04.382561044Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}