Spring Security SAML2 Service Provider: RelyingPartyRegistration may run arbitrary code on HTML forms generated by Spring Security filters
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-41003US | medium5.4 | — | ||
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.
Affected versions:
Spring Se… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/spring-projects/spring-securityPACKAGE
- https://github.com/spring-projects/spring-security/releases/tag/6.5.11WEB
- https://github.com/spring-projects/spring-security/releases/tag/7.0.6WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-41003ADVISORY
- https://spring.io/security/cve-2026-41003WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan