This vulnerability (CVE-2026-40993) affects Spring Security versions 7.0.0 through 7.0.5. It arises from the deserialization of untrusted data stored in the saml2_asserting_party_metadata database table managed by JdbcAssertingPartyMetadataRepository. Specifically, an attacker with write permissions to this table can insert malicious serialized payloads into the verification_credentials or encryption_credentials columns, potentially causing integrity and availability issues. The CVSS 3.1 score is 7.3 (high), reflecting attack complexity requiring high privileges but no user interaction, and impacts on integrity and availability with scope change. There is no vendor advisory or patch information available at this time.

An attacker with high privileges (write access to the relevant database table) can inject malicious serialized objects, potentially compromising the integrity and availability of the affected system components. Confidentiality impact is not indicated. The vulnerability could allow execution of malicious payloads during deserialization, leading to service disruption or data manipulation within Spring Security's SAML2 asserting party metadata handling.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict write access to the saml2_asserting_party_metadata database table to trusted users only. Monitor for unusual activity related to this table and consider additional application-level controls to validate or sanitize serialized data before deserialization.