VYPR
← All advisories
High severity7.6NVD Advisory· Published Jun 10, 2026· Updated Jun 12, 2026

CVE-2026-41003

CVE-2026-41003

Description

An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.

Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.springframework.security:spring-security-saml2-service-providerMaven
>= 7.0.0, < 7.0.67.0.6
org.springframework.security:spring-security-saml2-service-providerMaven
>= 6.5.0, < 6.5.116.5.11
org.springframework.security:spring-security-saml2-service-providerMaven
>= 6.4.0, <= 6.4.16—
org.springframework.security:spring-security-saml2-service-providerMaven
>= 6.3.0, <= 6.3.16—
org.springframework.security:spring-security-saml2-service-providerMaven
>= 5.8.0, <= 5.8.25—
org.springframework.security:spring-security-saml2-service-providerMaven
<= 5.7.23—

Affected products

2
  • VMware/Spring Security
    cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:*
    Range: >=5.7.0,<5.7.24
  • Spring Projects/Securityllm-create
    Range: 5.7.0 <= x <= 5.7.23 or 5.8.0 <= x <= 5.8.25 or 6.3.0 <= x <= 6.3.16 or 6.4.0 <= x <= 6.4.16 or 6.5.0 <= x <= 6.5.10 or 7.0.0 <= x <= 7.0.5

Patches

Vulnerability mechanics

References

5

News mentions

1