GHSA-WW38-37G9-M3Q3 Spring Security SAML2 Service Provider: Decryption Oracle Vulnerability from Unsigned SAML Response and Logout Payloads

🗓️ 10 Jun 2026 00:31:51Reported by GoogleType

osv🔗 osv.dev👁 8 Views

Spring Security SAML2 decrypts unsigned SAML responses and logout payloads, enabling attackers to use the service provider as a decryption oracle.

Reporter	Title	Published	Views	Family All 37
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	3 Aug 202611:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Explorer is affected by multiple vulnerabilites	6 Jul 202610:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	30 Jun 202610:02	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in spring-security-core jar (CVE-2026-40988, CVE-2026-41694)	27 Jul 202607:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Terracotta is affected by a Spring Security vulnerability that could allow Redirection to Untrusted Sites and Denial of Service (Dos) attacks	26 Jun 202618:27	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in watsonx.data	21 Aug 202608:20	–	ibm
CNNVD	Spring Security 加密问题漏洞	10 Jun 202600:00	–	cnnvd
CVE	CVE-2026-41694	9 Jun 202623:47	–	cve
Cvelist	CVE-2026-41694 SAML Payloads Decrypted Without Valid Signature	9 Jun 202623:47	–	cvelist
EUVD	EUVD-2026-35889	10 Jun 202600:31	–	euvd

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-41694
github	www.github.com/spring-projects/spring-security
github	www.github.com/spring-projects/spring-security/releases/tag/6.5.11
github	www.github.com/spring-projects/spring-security/releases/tag/7.0.6
spring	www.spring.io/security/cve-2026-41694

12 Aug 2026 16:41Current

4.7Medium risk

Vulners AI Score4.7

CVSS 3.13.7

EPSS0.00148