CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-41694

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 7.0%

CVSS Severity

CVSS v3 Score 3.7

References

https://spring.io/security/cve-2026-41694

Products affected by CVE-2026-41694

Vmware » Spring Security » Version: 5.7.0

cpe:2.3:a:vmware:spring_security:5.7.0
Vmware » Spring Security » Version: 5.7.1

cpe:2.3:a:vmware:spring_security:5.7.1
Vmware » Spring Security » Version: 5.7.10

cpe:2.3:a:vmware:spring_security:5.7.10
Vmware » Spring Security » Version: 5.7.11

cpe:2.3:a:vmware:spring_security:5.7.11
Vmware » Spring Security » Version: 5.7.12

cpe:2.3:a:vmware:spring_security:5.7.12
Vmware » Spring Security » Version: 5.7.13

cpe:2.3:a:vmware:spring_security:5.7.13
Vmware » Spring Security » Version: 5.7.14

cpe:2.3:a:vmware:spring_security:5.7.14
Vmware » Spring Security » Version: 5.7.2

cpe:2.3:a:vmware:spring_security:5.7.2
Vmware » Spring Security » Version: 5.7.22

cpe:2.3:a:vmware:spring_security:5.7.22
Vmware » Spring Security » Version: 5.7.23

cpe:2.3:a:vmware:spring_security:5.7.23
Vmware » Spring Security » Version: 5.7.3

cpe:2.3:a:vmware:spring_security:5.7.3
Vmware » Spring Security » Version: 5.7.4

cpe:2.3:a:vmware:spring_security:5.7.4
Vmware » Spring Security » Version: 5.7.5

cpe:2.3:a:vmware:spring_security:5.7.5
Vmware » Spring Security » Version: 5.7.6

cpe:2.3:a:vmware:spring_security:5.7.6
Vmware » Spring Security » Version: 5.7.7

cpe:2.3:a:vmware:spring_security:5.7.7
Vmware » Spring Security » Version: 5.7.8

cpe:2.3:a:vmware:spring_security:5.7.8
Vmware » Spring Security » Version: 5.7.9

cpe:2.3:a:vmware:spring_security:5.7.9
Vmware » Spring Security » Version: 5.8.0

cpe:2.3:a:vmware:spring_security:5.8.0
Vmware » Spring Security » Version: 5.8.1

cpe:2.3:a:vmware:spring_security:5.8.1
Vmware » Spring Security » Version: 5.8.10

cpe:2.3:a:vmware:spring_security:5.8.10
Vmware » Spring Security » Version: 5.8.11

cpe:2.3:a:vmware:spring_security:5.8.11
Vmware » Spring Security » Version: 5.8.12

cpe:2.3:a:vmware:spring_security:5.8.12
Vmware » Spring Security » Version: 5.8.13

cpe:2.3:a:vmware:spring_security:5.8.13
Vmware » Spring Security » Version: 5.8.14

cpe:2.3:a:vmware:spring_security:5.8.14
Vmware » Spring Security » Version: 5.8.15

cpe:2.3:a:vmware:spring_security:5.8.15
Vmware » Spring Security » Version: 5.8.16

cpe:2.3:a:vmware:spring_security:5.8.16
Vmware » Spring Security » Version: 5.8.2

cpe:2.3:a:vmware:spring_security:5.8.2
Vmware » Spring Security » Version: 5.8.24

cpe:2.3:a:vmware:spring_security:5.8.24
Vmware » Spring Security » Version: 5.8.25

cpe:2.3:a:vmware:spring_security:5.8.25
Vmware » Spring Security » Version: 5.8.3

cpe:2.3:a:vmware:spring_security:5.8.3
Vmware » Spring Security » Version: 5.8.4

cpe:2.3:a:vmware:spring_security:5.8.4
Vmware » Spring Security » Version: 5.8.5

cpe:2.3:a:vmware:spring_security:5.8.5
Vmware » Spring Security » Version: 5.8.6

cpe:2.3:a:vmware:spring_security:5.8.6
Vmware » Spring Security » Version: 5.8.7

cpe:2.3:a:vmware:spring_security:5.8.7
Vmware » Spring Security » Version: 5.8.8

cpe:2.3:a:vmware:spring_security:5.8.8
Vmware » Spring Security » Version: 5.8.9

cpe:2.3:a:vmware:spring_security:5.8.9
Vmware » Spring Security » Version: 6.3.0

cpe:2.3:a:vmware:spring_security:6.3.0
Vmware » Spring Security » Version: 6.3.1

cpe:2.3:a:vmware:spring_security:6.3.1
Vmware » Spring Security » Version: 6.3.10

cpe:2.3:a:vmware:spring_security:6.3.10
Vmware » Spring Security » Version: 6.3.15

cpe:2.3:a:vmware:spring_security:6.3.15
Vmware » Spring Security » Version: 6.3.16

cpe:2.3:a:vmware:spring_security:6.3.16
Vmware » Spring Security » Version: 6.3.2

cpe:2.3:a:vmware:spring_security:6.3.2
Vmware » Spring Security » Version: 6.3.3

cpe:2.3:a:vmware:spring_security:6.3.3
Vmware » Spring Security » Version: 6.3.4

cpe:2.3:a:vmware:spring_security:6.3.4
Vmware » Spring Security » Version: 6.3.5

cpe:2.3:a:vmware:spring_security:6.3.5
Vmware » Spring Security » Version: 6.3.6

cpe:2.3:a:vmware:spring_security:6.3.6
Vmware » Spring Security » Version: 6.3.7

cpe:2.3:a:vmware:spring_security:6.3.7
Vmware » Spring Security » Version: 6.3.8

cpe:2.3:a:vmware:spring_security:6.3.8
Vmware » Spring Security » Version: 6.3.9

cpe:2.3:a:vmware:spring_security:6.3.9
Vmware » Spring Security » Version: 6.4.0

cpe:2.3:a:vmware:spring_security:6.4.0
Vmware » Spring Security » Version: 6.4.1

cpe:2.3:a:vmware:spring_security:6.4.1
Vmware » Spring Security » Version: 6.4.10

cpe:2.3:a:vmware:spring_security:6.4.10
Vmware » Spring Security » Version: 6.4.11

cpe:2.3:a:vmware:spring_security:6.4.11
Vmware » Spring Security » Version: 6.4.15

cpe:2.3:a:vmware:spring_security:6.4.15
Vmware » Spring Security » Version: 6.4.16

cpe:2.3:a:vmware:spring_security:6.4.16
Vmware » Spring Security » Version: 6.4.2

cpe:2.3:a:vmware:spring_security:6.4.2
Vmware » Spring Security » Version: 6.4.3

cpe:2.3:a:vmware:spring_security:6.4.3
Vmware » Spring Security » Version: 6.4.4

cpe:2.3:a:vmware:spring_security:6.4.4
Vmware » Spring Security » Version: 6.4.5

cpe:2.3:a:vmware:spring_security:6.4.5
Vmware » Spring Security » Version: 6.4.6

cpe:2.3:a:vmware:spring_security:6.4.6
Vmware » Spring Security » Version: 6.4.7

cpe:2.3:a:vmware:spring_security:6.4.7
Vmware » Spring Security » Version: 6.4.8

cpe:2.3:a:vmware:spring_security:6.4.8
Vmware » Spring Security » Version: 6.4.9

cpe:2.3:a:vmware:spring_security:6.4.9
Vmware » Spring Security » Version: 6.5.0

cpe:2.3:a:vmware:spring_security:6.5.0
Vmware » Spring Security » Version: 6.5.1

cpe:2.3:a:vmware:spring_security:6.5.1
Vmware » Spring Security » Version: 6.5.10

cpe:2.3:a:vmware:spring_security:6.5.10
Vmware » Spring Security » Version: 6.5.2

cpe:2.3:a:vmware:spring_security:6.5.2
Vmware » Spring Security » Version: 6.5.3

cpe:2.3:a:vmware:spring_security:6.5.3
Vmware » Spring Security » Version: 6.5.4

cpe:2.3:a:vmware:spring_security:6.5.4
Vmware » Spring Security » Version: 6.5.5

cpe:2.3:a:vmware:spring_security:6.5.5
Vmware » Spring Security » Version: 6.5.9

cpe:2.3:a:vmware:spring_security:6.5.9
Vmware » Spring Security » Version: 7.0.0

cpe:2.3:a:vmware:spring_security:7.0.0
Vmware » Spring Security » Version: 7.0.1

cpe:2.3:a:vmware:spring_security:7.0.1
Vmware » Spring Security » Version: 7.0.2

cpe:2.3:a:vmware:spring_security:7.0.2
Vmware » Spring Security » Version: 7.0.3

cpe:2.3:a:vmware:spring_security:7.0.3
Vmware » Spring Security » Version: 7.0.4

cpe:2.3:a:vmware:spring_security:7.0.4
Vmware » Spring Security » Version: 7.0.5

cpe:2.3:a:vmware:spring_security:7.0.5

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2026-41694

Products

Pricing

Contact Us