CVE-2026-41003 Overview
CVE-2026-41003 is a cross-site scripting (XSS) vulnerability in Spring Security affecting SAML 2.0 relying party functionality. An attacker who can influence values stored in RelyingPartyRegistration may inject script content that executes within HTML forms generated by Spring Security filters. The flaw is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).
The vulnerability affects Spring Security versions 5.7.0 through 5.7.23, 5.8.0 through 5.8.25, 6.3.0 through 6.3.16, 6.4.0 through 6.4.16, 6.5.0 through 6.5.10, and 7.0.0 through 7.0.5.
Critical Impact
An attacker with the ability to influence RelyingPartyRegistration values can execute arbitrary script in HTML forms rendered by Spring Security filters, leading to session compromise or unauthorized actions in a victim's browser.
Affected Products
- Spring Security 5.7.0 through 5.7.23 and 5.8.0 through 5.8.25
- Spring Security 6.3.0 through 6.3.16, 6.4.0 through 6.4.16, and 6.5.0 through 6.5.10
- Spring Security 7.0.0 through 7.0.5
Discovery Timeline
- 2026-06-10 - CVE CVE-2026-41003 published to NVD
- 2026-06-10 - Last updated in NVD database
Technical Details for CVE-2026-41003
Vulnerability Analysis
The vulnerability resides in Spring Security's SAML 2.0 relying party support. Spring Security filters generate HTML forms containing values sourced from RelyingPartyRegistration objects. When those values are not properly neutralized, they are rendered into HTML without sufficient encoding.
An attacker who can influence registration metadata, such as identity provider entity identifiers, single sign-on URLs, or other registration parameters, can inject HTML or JavaScript payloads. The injected content executes in the context of the victim's browser when the generated form is rendered. Exploitation requires user interaction, typically navigation to the affected authentication endpoint.
The issue is classified as [CWE-79] Cross-Site Scripting. The CVSS vector indicates a scope change, meaning the impact extends beyond the vulnerable component to the user's browser security context.
Root Cause
The root cause is insufficient output encoding of RelyingPartyRegistration field values when Spring Security filters construct HTML forms. Trusted-looking configuration data is treated as safe markup rather than untrusted text requiring contextual HTML escaping.
Attack Vector
Exploitation requires an attacker to influence one or more values in a RelyingPartyRegistration. This typically requires low-privilege access to registration configuration sources, such as administrative interfaces, dynamic registration endpoints, or upstream identity provider metadata. The attacker then induces a user to visit an affected SAML endpoint where the malicious form is rendered, triggering script execution in the user's session. Refer to the Spring Security CVE-2026-41003 advisory for the authoritative description.
Detection Methods for CVE-2026-41003
Indicators of Compromise
- Unexpected HTML tags, <script> elements, event handlers, or javascript: URIs present in RelyingPartyRegistration field values
- Outbound requests from user browsers to attacker-controlled domains following visits to SAML authentication endpoints
- Modifications to relying party registration data from unexpected sources or accounts
Detection Strategies
- Inventory all Spring Security deployments and confirm versions against the affected ranges listed in the advisory
- Review SAML relying party registration configurations and metadata sources for HTML or script content in fields such as entity IDs, assertion consumer service URLs, and single logout URLs
- Inspect access logs for anomalous requests to SAML metadata, login, or logout endpoints that return user-influenced markup
Monitoring Recommendations
- Enable audit logging for changes to relying party registration configuration and alert on modifications outside approved change windows
- Monitor egress traffic from authentication flows for connections to unrecognized domains that may indicate script execution beaconing
- Add Content Security Policy violation reporting on authentication pages to detect script injection attempts
How to Mitigate CVE-2026-41003
Immediate Actions Required
- Upgrade Spring Security to a fixed release line beyond the affected ranges as specified in the Spring Security advisory
- Restrict and authenticate all sources that supply RelyingPartyRegistration values, including administrative APIs and federated metadata feeds
- Audit existing relying party registrations and remove any entries containing HTML, script content, or unexpected characters
Patch Information
VMware Spring has published fixes for the affected branches. Consult the Spring Security CVE-2026-41003 advisory for the specific fixed versions corresponding to each maintained release line and upgrade accordingly.
Workarounds
- Validate and sanitize all values written into RelyingPartyRegistration to reject HTML metacharacters before persistence
- Deploy a strict Content Security Policy on authentication endpoints to limit the impact of injected script
- Limit administrative access to SAML relying party configuration to a small set of trusted operators
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
