What is the CVSS score of CVE-2026-41003?

CVE-2026-41003 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Spring Security are affected by CVE-2026-41003?

Spring Security versions 5.7.x through 7.0.x contain a vulnerability in SAML-based authentication that allows attackers to execute malicious code in users' browsers, directly enabling credential…. A patch is available.

How to fix or mitigate CVE-2026-41003?

Within 24 hours: Identify all systems running Spring Security 5.7.x, 6.0.x, or 7.0.x with SAML 2.0 relying party functionality. Within 7 days: Restrict administrative changes to RelyingPartyRegistration configuration to authorized security and infrastructure teams only; implement Web Application Firewall (WAF) rules to detect and block XSS payloads in SAML form submissions. Within 30 days: Monitor Spring Security release channels for patched maintenance versions in 5.7.x, 6.0.x, and 7.0.x streams and deploy patches immediately upon availability.

Spring Security CVE-2026-41003

EUVD-2026-35887 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-10 security@vmware.com

GHSA-3pjj-qpw6-5fcm

XSS Java RCE Spring Security

5.4

CVSS 3.1 · NVD

Severity by source

Vendor (vmware) PRIMARY

HIGH

qualitative

NVD

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (vmware).

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Jun 12, 2026 - 20:37 NVD

HIGH MEDIUM

CVSS changed

Jun 12, 2026 - 20:37 NVD

7.6 (HIGH) 5.4 (MEDIUM)

Patch available

Jun 10, 2026 - 02:01 EUVD

Analysis Generated

Jun 10, 2026 - 00:31 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 maven packages depend on org.springframework.security:spring-security-saml2-service-provider (1 direct, 2 indirect)

Ecosystem-wide dependent count for version 7.0.0.

DescriptionNVD

An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.

Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

AnalysisAI

Cross-site scripting in Spring Security's SAML 2.0 relying party support allows an attacker who can influence RelyingPartyRegistration values to inject malicious content into HTML forms generated by Spring Security filters, potentially leading to script execution in a victim's browser. The advisory and tagging characterize this as an XSS issue with possible code-execution implications in the browser context, affecting Spring Security 5.7.x through 7.0.x prior to the fixed maintenance releases. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Spring Security is the de-facto authentication and authorization framework for Spring-based Java applications, and its saml2-service-provider module models SAML 2.0 relying parties through the RelyingPartyRegistration object, which holds identifiers, endpoints, and credentials used by Spring Security filters to generate SAML request/response HTML auto-submit forms. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning attacker-controlled values that flow into RelyingPartyRegistration are emitted into the generated HTML without sufficient escaping, allowing script-context injection. The 'RCE' tag in vendor metadata refers to arbitrary script execution within the generated form/browser context rather than server-side native code execution typical of OS-level RCE.

RemediationAI

Upgrade to a patched maintenance release on each supported branch as documented in the Spring advisory at https://spring.io/security/cve-2026-41003 - specifically the next release after the upper-bound listed for each branch (5.7.24, 5.8.26, 6.3.17, 6.4.17, 6.5.11, and 7.0.6 line successors per the affected ranges); exact fix versions should be confirmed against the vendor advisory before deployment. As compensating controls until patched, restrict who can create or modify RelyingPartyRegistration entries to trusted administrators only, avoid sourcing registration fields (entity IDs, ACS URLs, single logout URLs, name IDs) from untrusted SAML metadata or tenant-supplied input, and enforce a strict Content Security Policy that disallows inline scripts on Spring Security-served SAML endpoints - the CSP mitigation can break legitimate auto-post forms and SSO flows, so test against the SAML login and logout paths before rolling out broadly.