Description

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.

Affected Spring Products and Versions

Spring Security:

• 5.7.0 - 5.7.23
• 5.8.0 - 5.8.25
• 6.3.0 - 6.3.16
• 6.4.0 - 6.4.16
• 6.5.0 - 6.5.10
• 7.0.0 - 7.0.5
• Older, unsupported versions are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

Spring Security:

References

• https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N&version=3.1

History

• 2026-06-09: Initial vulnerability report published.