CVE-2026-41003: Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting
Published Jun 9, 2026
·Updated
An attacker able to influence values in RelyingPartyRegistration may be able to run arbitrary code on HTML forms generated by Spring Security filters. Affected versions: Spring Security 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; 7.0.0 through 7.0.5.
Affected Software
1 affected component
VMware Spring Security>=5.7.0<=5.7.23, >=5.8.0<=5.8.25, >=6.3.0<=6.3.16, >=6.4.0<=6.4.16, >=6.5.0<=6.5.10, >=7.0.0<=7.0.5
Event History
Jun 9, 2026
CVE Published
via MITRE·11:46 PM
Data Sourced
via MITRE·11:46 PM
DescriptionSeverityWeakness
Jun 10, 2026
Data Sourced
via NVD·12:16 AM
DescriptionSeverityWeakness