CVE-2026-41003: Spring Security RelyingPartyRegistration Code Injection Vulnerability

Technical summary

The vulnerability stems from insufficient input validation or output encoding when Spring Security constructs HTML forms that incorporate RelyingPartyRegistration values. RelyingPartyRegistration is a configuration object that defines how the application trusts external identity providers in OAuth2 or SAML workflows. By injecting JavaScript or HTML payloads into RelyingPartyRegistration properties—such as client names, URIs, or metadata endpoints—an attacker can break out of the intended data context and execute arbitrary code in the context of the user's session. The attack vector is network-based with low complexity; it requires prior authentication (PR:L) to modify configuration, plus user interaction (UI:R) to trigger the malicious form rendering. The CVSS 3.1 vector reflects that confidentiality is highly impacted while integrity and availability are less affected.

Business impact

This vulnerability creates a post-authentication privilege escalation and data theft risk. If an internal attacker, rogue administrator, or external threat actor gains write access to application configuration, they can hijack user sessions, exfiltrate sensitive data, or redirect users to phishing pages—all within a trusted application context. For organizations running multi-tenant or shared identity-provider setups, the impact extends across all users relying on that configuration. The requirement for prior authentication limits the blast radius compared to unauthenticated attacks, but the ability to influence a trusted interface significantly erodes user confidence and compliance posture.

Affected systems

Spring Security versions spanning five major releases are affected: 5.7.0–5.7.23, 5.8.0–5.8.25, 6.3.0–6.3.16, 6.4.0–6.4.16, 6.5.0–6.5.10, and 7.0.0–7.0.5. Any Java application using Spring Security for OAuth2 or SAML authentication with externally influenced or insufficiently validated RelyingPartyRegistration configurations is at risk. This includes microservices architectures, cloud-native deployments, and traditional enterprise applications that delegate authentication to external providers.

Exploitability

Active exploitation is not yet widespread because the vulnerability requires two conditions to align: (1) an attacker must first obtain the ability to modify RelyingPartyRegistration—either through compromised administrative credentials, insecure configuration management, or a supply-chain compromise—and (2) a legitimate user must access a form containing the injected payload. The attack is not unauthenticated, which raises the bar for opportunistic exploitation. However, the CVSS score of 7.6 (HIGH) and the cross-site scripting nature of the flaw make it an attractive target for sophisticated adversaries operating inside trust boundaries or targeting high-value accounts. The vulnerability is not yet listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.

Remediation

Upgrade to a patched version of Spring Security. Verify the exact patch version against the vendor advisory from VMware (the current maintainer of Spring Security). Organizations unable to patch immediately should review access controls on configuration management systems to ensure that only trusted administrators can modify RelyingPartyRegistration settings. Implement network segmentation to reduce the number of users who interact with affected applications, and monitor configuration change logs for unauthorized modifications. Consider using immutable or read-only configuration where possible.

Patch guidance

Consult the VMware Spring Security security advisory for the specific patch version corresponding to your branch (5.7.x, 5.8.x, 6.3.x, 6.4.x, 6.5.x, or 7.0.x). Apply patches in a controlled manner: test in a staging environment first, validate that identity provider integrations continue to function, and monitor for any behavioral changes. If you are on an end-of-life branch (e.g., 5.7.x or 5.8.x), consider upgrading to a long-term supported release line such as 6.5.x or 7.0.x (once patched) to receive ongoing security maintenance.

Detection guidance

Monitor your application logs and configuration audit trails for unexpected changes to RelyingPartyRegistration objects—particularly modifications to client names, provider URIs, or metadata. Implement Web Application Firewall (WAF) rules to detect JavaScript or HTML entity injection patterns in HTTP requests that might influence configuration. Use browser-based security headers (Content-Security-Policy, X-Frame-Options) to mitigate the impact if a form is compromised. Conduct a periodic review of who has administrative access to configuration management tools and identity provider settings.

Why prioritize this

Despite the authenticated-attacker requirement, this vulnerability scores HIGH (7.6) because it enables cross-site scripting in a high-trust context. Organizations should prioritize patching production environments within their normal patch cycle (typically 2–4 weeks) because the attack directly compromises user sessions and data confidentiality. The widespread presence across five major Spring Security versions means most organizations running Spring-based authentication infrastructure are likely affected. The fact that it is not yet in the KEV catalog should not delay remediation—threat actors are likely aware of the issue and may target organizations with weak change-management controls.

Risk score, explained

The CVSS 3.1 score of 7.6 reflects: Network-accessible attack vector (AV:N), low attack complexity (AC:L), requirement for low-privilege authentication (PR:L), and user interaction (UI:R). Scope changes to reflected in downstream systems (S:C). High confidentiality impact (C:H) from stolen session data, low integrity impact (I:L) from form injection, and no availability impact (A:N). This HIGH rating appropriately balances the post-authentication nature of the attack with its ability to compromise user sessions across trust boundaries.

Frequently asked questions