GitHub Advisoryadvisory · Maven
GHSA-2q7c-5gjm-7q23 Spring Security SAML2 Service Provider is vulnerable to Deserialization of Untrusted Data via JdbcAssertingPartyMetadataRepository
HIGH
Official page ↗
- Aliases
- CVE-2026-40993
- Ecosystem
- Maven
- Packages
- org.springframework.security:spring-security-saml2-service-provider
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:H
- Weaknesses
- CWE-502
- Reviewed
- 2026-08-12
Affected packages
• Maven org.springframework.security:spring-security-saml2-service-provider: >= 7.0.0, < 7.0.6 → fixed in 7.0.6
Description
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).
Affected versions:
Spring Security 7.0.0 through 7.0.5.
Related
Alias · CVE (1)
- CVE-2026-40993 An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata)… vulnerability
Weakness · CWE (1)
- CWE-502 Deserialization of Untrusted Data weakness