CVE-2026-41694 is a vulnerability in Spring Security SAML where the product decrypts SAML Responses and parts of LogoutRequests and LogoutResponses without enforcing valid cryptographic signature verification. This improper verification (CWE-347) could enable attackers to craft malicious SAML payloads and leverage the service provider as a decryption oracle. The affected versions include Spring Security 5.7.0 through 5.7.23, 5.8.0 through 5.8.25, 6.3.0 through 6.3.16, 6.4.0 through 6.4.16, 6.5.0 through 6.5.10, and 7.0.0 through 7.0.5. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

The vulnerability allows attackers to bypass signature verification on certain SAML payloads, potentially enabling them to use the service provider as a decryption oracle. This could lead to limited confidentiality impact as indicated by the CVSS vector (Confidentiality Low). There is no impact on integrity or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor Spring's official advisories for updates. Until a fix is available, consider restricting or closely monitoring SAML traffic and usage to mitigate potential exploitation.