CVE-2026-40997 SOAP security faults leak Spring Security account state

Several Spring WS integration paths with Spring Security could surface detailed account state for example locked or disabled user semantics to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote...

EUVD-2026-36207

Several Spring WS integration paths with Spring Security could surface detailed account state for example locked or disabled user semantics to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote...

CVE-2026-40995

CVE-2026-40995 affects Spring Web Services versions 3.1.0–3.1.8, 4.0.0–4.0.18, 4.1.0–4.1.3, and 5.0.0–5.0.1. The issue arises in the X509AuthenticationProvider, which could issue a fully authenticated X509AuthenticationToken when a presented certificate maps to a UserDetails, without applying Spr...

CVE-2026-40995 X.509 authentication bypasses Spring Security account checks

X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks disabled, locked, expired, or credentials-expired accounts. Affected versions: Spring Web...

CVE-2026-40995 X.509 authentication bypasses Spring Security account checks

X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks disabled, locked, expired, or credentials-expired accounts. Affected versions: Spring Web...

CVE-2026-40995 X.509 authentication bypasses Spring Security account checks

X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks disabled, locked, expired, or credentials-expired accounts. Affected versions: Spring Web...

CVE-2026-41694

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affected versions: Spring Security 5.7.0...

CVE-2026-41706

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is us...

CVE-2026-41008

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can lead to an Open Redirect...

CVE-2026-40997: Generation of Error Message Containing Sensitive Information

Several Spring WS integration paths with Spring Security could surface detailed account state for example locked or disabled user semantics to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote...

PT-2026-48620

Name of the Vulnerable Software and Affected Versions Spring Web Services versions 5.0.0 through 5.0.1 Spring Web Services versions 4.1.0 through 4.1.3 Spring Web Services versions 4.0.0 through 4.0.18 Spring Web Services versions 3.1.0 through 3.1.8 Description Integration paths between Spring W...

PT-2026-80231

Several Spring WS integration paths with Spring Security could surface detailed account state for example locked or disabled user semantics to remote SOAP clients through exception messages or callback outcomes, instead of failing with generic authentication errors. That behavior assists remote...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview org.springframework.security:spring-security-saml2-service-provider is a security component for the Spring Framework. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification in the REDIRECT binding. An attacker can exhaust system...

com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0-m1, <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0-m1, =1.52.0, =2.0.1, =4.0.0-m1, =4.0.0-m1, =4.0.0-rc1, =4.0.6 Source cves: CVE-2026-40988 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKSECURITY-17315633...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), com.eurodyn.qlack.fuse:qlack-fuse-aaa (>=3.9.8, <=3.9.9) +116 more potentially affected by CVE-2026-40988 via org.springframework.security:spring-security-saml2-service-provider (>=6.0.8, <=6.5.10)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.0.8, =1.0.0.ee-20260424025040, =3.9.8, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =1.0.6, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves:...

ai.wavemaker.runtime:wavemaker-app-runtime-core (>=1.0.0.ee-20260424025040, <=1.0.0-20260628114628), com.eurodyn.qlack.fuse:qlack-fuse-aaa (>=3.9.8, <=3.9.9) +116 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=6.0.8, <=6.5.10)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =6.0.8, =1.0.0.ee-20260424025040, =3.9.8, =1.6.0, =11.9.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =dce37d6e6c310e0d86c4f0d73f8846b8ef2f4432, =1.0.6, =2026.0-19, =2026.0-19, =2026.1.3 and more Source cves:...

Cross-site Scripting (XSS)

Overview org.springframework.security:spring-security-saml2-service-provider is a security component for the Spring Framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the RelyingPartyRegistration function. An attacker can execute arbitrary scripts in the...

com.erudika:para-server (>=1.52.0, <=1.54.7), io.orqueio.bpm.springboot:orqueio-bpm-spring-boot-starter-security (>=2.0.1, <=2.0.7) +3 more potentially affected by CVE-2026-41003 via org.springframework.security:spring-security-saml2-service-provider (>=7.0.0-m1, <=7.0.5)

org.springframework.security:spring-security-saml2-service-provider MAVEN version =7.0.0-m1, =1.52.0, =2.0.1, =4.0.0-m1, =4.0.0-m1, =4.0.0-rc1, =4.0.6 Source cves: CVE-2026-41003 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKSECURITY-17315632...

ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +5285 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (>=6.0.0, <=6.5.10)

org.springframework.security:spring-security-web MAVEN version =6.0.0, =cloud-0.1, =0.0.2, =0.0.2, =0.8.1, =0.0.3, =0.8.1, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040, =1.0.0.ee-20260424025040,...

be.appify.prefab:prefab-security (>=0.2.0, <=0.10.9), br.com.sawcunhaos:scos-foundation-security (1.1.0) +1551 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (>=7.0.0-m1, <=7.0.5)

org.springframework.security:spring-security-web MAVEN version =7.0.0-m1, =0.2.0, =5.0.0, =5.0.0, =5.0.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =4.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...