CVE-2026-41694
published 2026-06-10CVE-2026-41694: Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.14%
3.5th percentile
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.
Affected versions:
Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| spring | spring_security | >= 5.7.0 < 5.7.24 | 5.7.24 |
| spring | spring_security | >= 5.8.0 < 5.8.26 | 5.8.26 |
| spring | spring_security | >= 6.3.0 < 6.3.17 | 6.3.17 |
| spring | spring_security | >= 6.4.0 < 6.4.17 | 6.4.17 |
| spring | spring_security | >= 6.5.0 < 6.5.10.2 | 6.5.10.2 |
| spring | spring_security | >= 7.0.0 < 7.0.5.1 | 7.0.5.1 |
| vmware | spring_security | >= 5.7.0 < 5.7.24 | 5.7.24 |
| vmware | spring_security | >= 5.8.0 < 5.8.26 | 5.8.26 |
| vmware | spring_security | >= 6.3.0 < 6.3.17 | 6.3.17 |
| vmware | spring_security | >= 6.4.0 < 6.4.17 | 6.4.17 |
| vmware | spring_security | >= 6.5.0 < 6.5.10.2 | 6.5.10.2 |
| vmware | spring_security | >= 7.0.0 < 7.0.5.1 | 7.0.5.1 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Vmware Spring Security up to 7.0.5 SAML Response signature verification (CNNVD-202606-2873)
vuldb·2026-06-15·CVSS 5.3
CVE-2026-41694 [MEDIUM] Vmware Spring Security up to 7.0.5 SAML Response signature verification (CNNVD-202606-2873)
A vulnerability classified as problematic was found in Vmware Spring Security up to 7.0.5. Affected is an unknown function of the component SAML Response Handler. Executing a manipulation can lead to improper verification of cryptographic signature.
This vulnerability is handled as CVE-2026-41694. The attack can be executed remotely. There is not any exploit available.
Upgrading the affected component is advised.
GHSA
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payload
ghsa_unreviewed·2026-06-10
CVE-2026-41694 [LOW] CWE-347 Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payload
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.
Affected versions:
Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-10
Published