Spring Security 7.0: CacheSaml2AuthenticationRequestRepository should read relayState from authenticationRequest
06:08 14 May 2026

I recently upgraded my project to Spring Boot 4 and found that SAML SSO is broken. It appears the CacheSaml2AuthenticationRequestRepository does not yet include the fix mentioned in gh-18243 within the Spring Security 7.0.x line. I can confirm the fix is working as expected in 6.5.9, but it appears to be missing in 7.0.5. When is this fix scheduled to be merged into 7.0.x ? Is there a recommended milestone or a specific snapshot build I should use in the meantime to restore SSO functionality while we wait for the next maintenance release?

spring-security