Spring Security allows unfiltered Java deserialization of SAML 2.0 asserting party credentials stored in a database table. If an attacker writes malicious serialized objects into the columns containing verification or encryption credentials, those objects can be later deserialized by the application, resulting in execution of arbitrary code. The weakness is classified as CWE‑502, reflecting insecure deserialization.

The issue affects Spring Security 7.0.0 through 7.0.5, specifically the JdbcAssertingPartyMetadataRepository component that manages the saml2_asserting_party_metadata table. Users deploying these versions of Spring Security are potentially at risk when the database allows write access to that table.

The CVSS score of 7.3 indicates a high severity for this vulnerability. The EPSS score is not available, and the vulnerability is not currently listed in CISA KEV. Exploitation requires the attacker to have write permissions to the saml2_asserting_party_metadata table, a condition that could arise from misconfiguration or an insider with database access. If write privileges are granted, the attacker can implant a malicious payload that will be deserialized later during SAML processing, providing a path to remote code execution.