CVE-2020-5407: Pivotal Software Spring Security

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

Spring Security versions 5.2.x prior to 5.2.4 and 5.3.x prior to 5.3.2 contain a signature wrapping vulnerability during SAML response validation. When using the spring-security-saml2-service-provider component, a malicious user can carefully modify an otherwise valid SAML response and append an arbitrary assertion that Spring Security will accept as valid.

Affected products

• Pivotal Software Spring Security: from 5.2.0, before 5.2.4 (fixed in 5.2.4); from 5.3.0, before 5.3.2 (fixed in 5.3.2)

Published 2020-05-13. Last modified 2026-06-17.