CVE-2026-41694: Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads

June 10, 2026 (updated August 12, 2026)

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.

Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

References

github.com/advisories/GHSA-ww38-37g9-m3q3
github.com/spring-projects/spring-security/releases/tag/6.5.11
github.com/spring-projects/spring-security/releases/tag/7.0.6
nvd.nist.gov/vuln/detail/CVE-2026-41694
spring.io/security/cve-2026-41694

Code Behaviors & Features

Detect and mitigate CVE-2026-41694 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →