Package · Maven

org.springframework.security:spring-security-saml2-service-provider

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

Low 3.7

CVE-2026-41694

SAML Payloads Decrypted Without Valid Signature

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle. Affe…

Spring Spring Security org.springframework.security:spring-security-saml2-service-provider Maven

Jun 9, 2026