This vulnerability (CVE-2026-41003) in Spring Security involves improper neutralization of input (CWE-79) during the generation of HTML forms by Spring Security filters. An attacker who can influence values in RelyingPartyRegistration may execute arbitrary code in the context of these forms. Affected versions include Spring Security 5.7.0 through 5.7.23, 5.8.0 through 5.8.25, 6.3.0 through 6.3.16, 6.4.0 through 6.4.16, 6.5.0 through 6.5.10, and 7.0.0 through 7.0.5. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation could allow an attacker with limited privileges to execute arbitrary code in the HTML forms generated by Spring Security filters, potentially leading to partial compromise of confidentiality and integrity. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, user interaction required, and scope change with high confidentiality impact, low integrity impact, and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, review and restrict the ability to influence RelyingPartyRegistration values to trusted sources only. Monitor vendor communications for updates and apply official patches once available.