This vulnerability (CVE-2026-41003) involves improper neutralization of input during web page generation (CWE-79) in Spring Security. Specifically, an attacker able to control values in RelyingPartyRegistration may execute arbitrary code via HTML forms generated by Spring Security filters. The affected versions include 5.7.0 through 5.7.23, 5.8.0 through 5.8.25, 6.3.0 through 6.3.16, 6.4.0 through 6.4.16, 6.5.0 through 6.5.10, and 7.0.0 through 7.0.5. The CVSS v3.1 base score is 7.6, indicating high severity with network attack vector, low attack complexity, requiring low privileges and user interaction, and impacts confidentiality highly and integrity partially, with no availability impact. There is no vendor advisory or patch information available at this time.

Successful exploitation could allow an attacker with the ability to influence RelyingPartyRegistration values to execute arbitrary code in the context of HTML forms generated by Spring Security filters. This can lead to partial integrity compromise and high confidentiality impact. There is no known exploitation in the wild and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should carefully validate and sanitize any input that may influence RelyingPartyRegistration values to reduce risk. Monitor vendor channels for updates and apply patches promptly once available.