CVE-2026-41694CWE-347

SAML Payloads Decrypted Without Valid Signature

Low · published June 9, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
7.3
In the wild
Unconfirmed
What it is

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.

Affected versions:

Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00181 · 7.3th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-06-09T23:47Z
EPSS history
Timeline
  • 09 JUN 23:47Z
    SAML Payloads Decrypted Without Valid Signature
    cvelistv5