CVE-2026-41003 Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
MediumCVSS 5.4
EPSS 0.20%
- Published
- Updated
- Exploit status
- No public exploit known
Description
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters.
Affected versions:
Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Spring Security | >= 5.7.0, < 5.7.24 | 5.7.24 |
| Spring Security | >= 5.8.0, < 5.8.26 | 5.8.26 |
| Spring Security | >= 6.3.0, < 6.3.17 | 6.3.17 |
| Spring Security | >= 6.4.0, < 6.4.17 | 6.4.17 |
| Spring Security | >= 6.5.0, < 6.5.10.2 | 6.5.10.2 |
| Spring Security | >= 7.0.0, < 7.0.5.1 | 7.0.5.1 |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | >= 7.0.0, < 7.0.6 | 7.0.6 |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 7.0.0 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 7.0.1 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 7.0.2 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 7.0.3 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 7.0.4 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 7.0.5 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | >= 6.5.0, < 6.5.11 | 6.5.11 |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.5.0 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.5.1 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.5.10 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.5.2 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.5.3 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.5.4 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.5.5 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.5.6 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.5.7 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.5.8 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.5.9 | No fix listed |
Show 133 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.springframework.security/spring-security-saml2-service-provider(Maven) | >= 6.4.0, <= 6.4.16 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.0 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.1 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.10 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.11 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.12 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.13 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.2 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.3 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.4 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.5 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.6 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.7 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.8 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.4.9 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | >= 6.3.0, <= 6.3.16 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.3.0 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.3.1 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.3.10 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.3.2 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.3.3 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.3.4 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.3.5 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.3.6 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.3.7 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.3.8 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 6.3.9 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | >= 5.8.0, <= 5.8.25 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.0 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.1 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.10 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.11 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.12 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.13 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.14 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.15 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.16 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.2 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.3 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.4 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.5 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.6 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.7 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.8 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.8.9 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | <= 5.7.23 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.0.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.1.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.10.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.11.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.12.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.13.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.14.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.15.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.2.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.3.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.4.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.5.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.6.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.7.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.8.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.2.9.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.0.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.1.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.10.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.11.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.12.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.13.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.2.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.3.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.4.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.5.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.6.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.7.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.8.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.3.9.RELEASE | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.4.0 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.4.1 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.4.10 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.4.11 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.4.2 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.4.3 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.4.4 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.4.5 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.4.6 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.4.7 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.4.8 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.4.9 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.5.0 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.5.1 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.5.2 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.5.3 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.5.4 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.5.5 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.5.6 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.5.7 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.5.8 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.6.0 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.6.1 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.6.10 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.6.11 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.6.12 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.6.2 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.6.3 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.6.4 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.6.5 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.6.6 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.6.7 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.6.8 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.6.9 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.0 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.1 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.10 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.11 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.12 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.13 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.14 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.2 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.3 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.4 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.5 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.6 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.7 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.8 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | = 5.7.9 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | >= 7.0.0, <= 7.0.5 | No fix listed |
| org.springframework.security/spring-security-saml2-service-provider(Maven) | >= 6.5.0, <= 6.5.10 | No fix listed |
| VMware spring security | >= 5.7.0, < 5.7.24 | 5.7.24 |
| VMware spring security | >= 5.8.0, < 5.8.26 | 5.8.26 |
| VMware spring security | >= 6.3.0, < 6.3.17 | 6.3.17 |
| VMware spring security | >= 6.4.0, < 6.4.17 | 6.4.17 |
| VMware spring security | >= 6.5.0, < 6.5.10.2 | 6.5.10.2 |
| VMware spring security | >= 7.0.0, < 7.0.5.1 | 7.0.5.1 |
References
- spring.io vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- github.com
- github.com
- github.com