CVE-2026-41694
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Vulnerability in Spring Security SAML allows attackers to decrypt SAML Responses and LogoutRequest/LogoutResponse elements without a valid signature, enabling the Service Provider to be used as a decryption oracle. Affects versions 5.7.0-5.7.23, 5.8.0-5.8.25, 6.3.0-6.3.16, 6.4.0-6.4.16, 6.5.0-6.5.10, 7.0.0-7.0.5.
Risk Assessment
The risk involves potential decryption of sensitive SAML data, leading to confidentiality and authentication breaches.
Recommendation
Update Spring Security to a patched version (e.g., 5.7.24, 5.8.26, 6.3.17, 6.4.17, 6.5.11, 7.0.6).
Original NVD description (English source)
Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.