CVE-2026-40993
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: NVD
Description
An attacker with write permissions to the database table managed by JdbcAssertingPartyMetadataRepository (saml2_asserting_party_metadata) may be able to store malicious serialized payloads in the columns containing the collection of verification or encryption credentials (verification_credentials and encryption_credentials, respectively).
Affected versions:
Spring Security 7.0.0 through 7.0.5.
Affected (1)
Products: Vmware: Spring Security
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| From 7.0.0 to 7.0.5.1 |
References (1)
Timeline
No history available yet.