CVE-2026-41003CWE-79
Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
High · published June 9, 2026
What it is
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.
Affected versions:
Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
The record
Technical detail
- CVSS v3.1
- 7.6 · HIGH
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00253 · 15.9th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-06-09T23:46Z
EPSS history
Timeline