7.6 HighCWE-79
CVE-2026-41003
Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
SpringSpring Security
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.2%probability of exploitation in the next 30 days
Higher than 10% of scored CVEs
SeverityCVSS
7.6High
Description NVD
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
Coverage 1 article · 1 outlet
- Spring Framework Patches Critical Flaws, Urges Immediate UpgradeSecurityOnline · first in our coverage · mentions it in passing