org.springframework.security:spring-security-saml2-service-provider vulnerabilities (TuxCare)
19 vulnerabilities.
org.springframework.security:spring-security-saml2-service-providerTuxCareTiming Attack via Non-Constant-Time Comparison of Sensitive Values5.9 Mediumorg.springframework.security:spring-security-saml2-service-providerTuxCareSpring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces9.4 Criticalorg.springframework.security:spring-security-saml2-service-providerTuxCareDeterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Correlation6.5 Mediumorg.springframework.security:spring-security-saml2-service-providerTuxCareWebAuthn User Verification Bypass via Session Serialization7.4 Highorg.springframework.security:spring-security-saml2-service-providerTuxCareUnauthorized User Impersonation when Using X.509 Client Certificates6.8 Mediumorg.springframework.security:spring-security-saml2-service-providerTuxCareOpen Redirect When Using CookieRequestCache6.1 Mediumorg.springframework.security:spring-security-saml2-service-providerTuxCareSAML Payloads Decrypted Without Valid Signature3.7 Loworg.springframework.security:spring-security-saml2-service-providerTuxCareUnencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting7.6 Highorg.springframework.security:spring-security-saml2-service-providerTuxCareUnbounded DEFLATE Inflation in SAML 2.0 Service Provider7.5 Highorg.springframework.security:spring-security-saml2-service-providerTuxCarePotential Security Misconfiguration when Using withIssuerLocation5.3 Mediumorg.springframework.security:spring-security-saml2-service-providerTuxCareUnauthorized User Impersonation when Using X.509 Client Certificates6.8 Mediumorg.springframework.security:spring-security-saml2-service-providerTuxCareUser Attribute Enumeration when Using DaoAuthenticationProvider3.7 Loworg.springframework.security:spring-security-saml2-service-providerTuxCareSpring Security JdbcOneTimeTokenService allows a one-time token to authenticate multiple sessions4.8 Mediumorg.springframework.security:spring-security-saml2-service-providerTuxCareUnder Some Conditions Spring Security HTTP Headers Are not Written9.1 Criticalorg.springframework.security:spring-security-saml2-service-providerTuxCareSpring Security Vulnerable to Authorization Bypass via Security Annotations5.3 Mediumorg.springframework.security:spring-security-saml2-service-providerTuxCareCVE-2025-22228: Spring Security BCryptPasswordEncoder does not enforce maximum password length7.4 Highorg.springframework.security:spring-security-saml2-service-providerTuxCareSpring Security Authorization Bypass for Case Sensitive Comparisons4.8 Mediumorg.springframework.security:spring-security-saml2-service-providerTuxCareAuthorization Bypass of Static Resources in WebFlux Applications9.1 Criticalorg.springframework.security:spring-security-saml2-service-providerTuxCareErroneous authentication pass in Spring Security8.2 High