GHSA-ww38-37g9-m3q3

Since Spring Security SAML decrypts SAML Responses as well as elements of SAML LogoutRequests and LogoutResponses without requiring a valid signature, attackers may be able to craft these SAML payloads and use the Service Provider as a decryption oracle.

Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.

Database specific

{
    "cwe_ids":  [
        "CWE-347"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-12T16:22:24Z",
    "nvd_published_at":  "2026-06-10T00:16:50Z",
    "severity":  "LOW"
}

References

Affected packages

Maven

org.springframework.security:spring-security-saml2-service-provider

Package

Name: org.springframework.security:spring-security-saml2-service-provider; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-saml2-service-provider

Affected ranges

Type: ECOSYSTEM
Events: Introduced

7.0.0

Fixed

7.0.6

Affected versions

7.*

7.0.0

7.0.1

7.0.2

7.0.3

7.0.4

7.0.5

Database specific

last_known_affected_version_range

"<= 7.0.5"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-ww38-37g9-m3q3/GHSA-ww38-37g9-m3q3.json"

org.springframework.security:spring-security-saml2-service-provider

Package

Name: org.springframework.security:spring-security-saml2-service-provider; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-saml2-service-provider

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.5.0

Fixed

6.5.11

Affected versions

6.*

6.5.0

6.5.1

6.5.2

6.5.3

6.5.4

6.5.5

6.5.6

6.5.7

6.5.8

6.5.9

6.5.10

Database specific

last_known_affected_version_range

"<= 6.5.10"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-ww38-37g9-m3q3/GHSA-ww38-37g9-m3q3.json"

org.springframework.security:spring-security-saml2-service-provider

Package

Name: org.springframework.security:spring-security-saml2-service-provider; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-saml2-service-provider

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.4.0

Last Affected

6.4.16

Affected versions

6.*

6.4.0

6.4.1

6.4.2

6.4.3

6.4.4

6.4.5

6.4.6

6.4.7

6.4.8

6.4.9

6.4.10

6.4.11

6.4.12

6.4.13

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-ww38-37g9-m3q3/GHSA-ww38-37g9-m3q3.json"

org.springframework.security:spring-security-saml2-service-provider

Package

Name: org.springframework.security:spring-security-saml2-service-provider; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-saml2-service-provider

Affected ranges

Type: ECOSYSTEM
Events: Introduced

6.3.0

Last Affected

6.3.16

Affected versions

6.*

6.3.0

6.3.1

6.3.2

6.3.3

6.3.4

6.3.5

6.3.6

6.3.7

6.3.8

6.3.9

6.3.10

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-ww38-37g9-m3q3/GHSA-ww38-37g9-m3q3.json"

org.springframework.security:spring-security-saml2-service-provider

Package

Name: org.springframework.security:spring-security-saml2-service-provider; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-saml2-service-provider

Affected ranges

Type: ECOSYSTEM
Events: Introduced

5.8.0

Last Affected

5.8.25

Affected versions

5.*

5.8.0

5.8.1

5.8.2

5.8.3

5.8.4

5.8.5

5.8.6

5.8.7

5.8.8

5.8.9

5.8.10

5.8.11

5.8.12

5.8.13

5.8.14

5.8.15

5.8.16

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-ww38-37g9-m3q3/GHSA-ww38-37g9-m3q3.json"

org.springframework.security:spring-security-saml2-service-provider

Package

Name: org.springframework.security:spring-security-saml2-service-provider; View open source insights on deps.dev
Purl: pkg:maven/org.springframework.security/spring-security-saml2-service-provider

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

5.7.23

Affected versions

5.*

5.2.0.RELEASE

5.2.1.RELEASE

5.2.2.RELEASE

5.2.3.RELEASE

5.2.4.RELEASE

5.2.5.RELEASE

5.2.6.RELEASE

5.2.7.RELEASE

5.2.8.RELEASE

5.2.9.RELEASE

5.2.10.RELEASE

5.2.11.RELEASE

5.2.12.RELEASE

5.2.13.RELEASE

5.2.14.RELEASE

5.2.15.RELEASE

5.3.0.RELEASE

5.3.1.RELEASE

5.3.2.RELEASE

5.3.3.RELEASE

5.3.4.RELEASE

5.3.5.RELEASE

5.3.6.RELEASE

5.3.7.RELEASE

5.3.8.RELEASE

5.3.9.RELEASE

5.3.10.RELEASE

5.3.11.RELEASE

5.3.12.RELEASE

5.3.13.RELEASE

5.4.0

5.4.1

5.4.2

5.4.3

5.4.4

5.4.5

5.4.6

5.4.7

5.4.8

5.4.9

5.4.10

5.4.11

5.5.0

5.5.1

5.5.2

5.5.3

5.5.4

5.5.5

5.5.6

5.5.7

5.5.8

5.6.0

5.6.1

5.6.2

5.6.3

5.6.4

5.6.5

5.6.6

5.6.7

5.6.8

5.6.9

5.6.10

5.6.11

5.6.12

5.7.0

5.7.1

5.7.2

5.7.3

5.7.4

5.7.5

5.7.6

5.7.7

5.7.8

5.7.9

5.7.10

5.7.11

5.7.12

5.7.13

5.7.14

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-ww38-37g9-m3q3/GHSA-ww38-37g9-m3q3.json"