Vulnerability · Published Jun 9, 2026 · Assigned by vmware
CVE-2026-41003Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
High 7.6
In plain English
A high-severity cross-site scripting in Spring Security from Spring. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | org.springframework.security:spring-security-saml2-service-provider | 7.0.6 | GHSA-3pjj-qpw6-5fcm |
| Maven | org.springframework.security:spring-security-saml2-service-provider | 6.5.11 | GHSA-3pjj-qpw6-5fcm |
| Maven | org.springframework.security:spring-security-saml2-service-provider | no fix listed | GHSA-3pjj-qpw6-5fcm |
| Maven | org.springframework.security:spring-security-saml2-service-provider | no fix listed | GHSA-3pjj-qpw6-5fcm |
| Maven | org.springframework.security:spring-security-saml2-service-provider | no fix listed | GHSA-3pjj-qpw6-5fcm |
| Maven | org.springframework.security:spring-security-saml2-service-provider | no fix listed | GHSA-3pjj-qpw6-5fcm |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Spring | Spring Security | 5.7.0 – before 5.7.245.8.0 – before 5.8.266.3.0 – before 6.3.176.4.0 – before 6.4.176.5.0 – before 6.5.10.27.0.0 – before 7.0.5.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N