Spring Security SAML does not properly verify cryptographic signatures before decrypting SAML Responses and elements of LogoutRequests and LogoutResponses. This flaw (CWE-347) allows attackers to submit crafted SAML payloads that the service provider decrypts without signature validation, potentially enabling the service provider to be used as a decryption oracle. The vulnerability affects Spring Security versions 5.7.0 through 5.7.23; 5.8.0 through 5.8.25; 6.3.0 through 6.3.16; 6.4.0 through 6.4.16; 6.5.0 through 6.5.10; and 7.0.0 through 7.0.5. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

The vulnerability allows attackers to craft SAML payloads that are decrypted by the service provider without verifying the signature, potentially enabling the service provider to be used as a decryption oracle. The impact is limited to confidentiality (low impact on confidentiality), with no reported impact on integrity or availability. The CVSS base score of 3.7 reflects this low severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Spring Security advisories for updates. Until a fix is available, consider restricting or validating SAML inputs through additional controls if possible.