CVE-2026-41003: Unencoded HTML Outputs in Spring Security May Allow Cross-Site Scripting

Synopsis

A stored cross-site scripting (XSS) vulnerability exists in Spring Security's HTML form rendering, specifically in how values from RelyingPartyRegistration are written into generated HTML without proper encoding. An attacker who can influence those registration values, over the network with a low-privilege account, can inject malicious scripts that execute in a victim's browser when they interact with the affected form. Successful exploitation reads sensitive data from the victim's session (including session tokens) and allows limited tampering with page content. Patched-image rebuilds at versions 5.7.24, 5.8.26, 6.3.17, 6.4.17, and 6.5.11 are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Spring Security application over the network to submit or influence RelyingPartyRegistration values.

• AuthenticationRequired

  A low-privilege account is sufficient; the attacker must be authenticated to influence the relevant registration values.

• Victim interactionRequired

  A victim must interact with (for example, load or submit) the HTML form generated by Spring Security for the injected script to execute in their browser.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or environmental prerequisites beyond the attacker's ability to influence registration values.

Blast Radius

• Reads the victim's active session tokens and any sensitive data exposed in the browser session context.
• Injects and executes arbitrary JavaScript in the victim's browser under the application's origin.
• Allows limited modification of page content visible to the victim, such as altering form fields or displayed data.