Spring Security CVE-2026-47841

Two specific, non-default conditions must both be present: (1) the application must have Spring Security's WebAuthn support explicitly enabled and deployed for user authentication, and (2) the application must be configured with a distributed HTTP session store (e.g., Spring Session backed by Redis, Hazelcast, JDBC, or another cluster-aware store). Applications using the default JVM in-memory HttpSession are not vulnerable. Exploitation is further limited by AC:H - the attacker must be able to interact with the WebAuthn authentication ceremony across a distributed session context, requiring knowledge of the target's username and the ability to time or route requests across session nodes. Factors limiting exploitation: WebAuthn is not a default Spring Security feature and requires explicit configuration; distributed session stores require deliberate infrastructure setup; the attacker cannot exploit this against any arbitrary Spring application.

The NVD CVSS 7.4 (High) vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N accurately reflects the risk profile: network-exploitable with no authentication required, but constrained to high complexity (AC:H) because exploitation requires a specific, non-default deployment - both WebAuthn support and a distributed HTTP session store must be explicitly configured. In practice, AC:H substantially limits the affected population: applications using only the default in-memory session store are not vulnerable. However, organizations deploying Spring Boot at scale in clustered or cloud-native environments (where distributed sessions via Redis/Spring Session are common) face material risk. The C:H/I:H impact is significant - a successful bypass allows full impersonation of a legitimate WebAuthn-authenticated user. EPSS data was not provided, preventing quantitative exploitation probability assessment. No CISA KEV listing and no POC reported reduce immediate urgency, but the vendor (VMware/Broadcom, Spring's maintainer) self-reported the issue, indicating direct knowledge of the flaw. The version range spanning three major Spring Security release lines (6.4, 6.5, 7.0, 7.1) broadens exposure.

An attacker targeting a Spring Boot application that uses passkey/WebAuthn login with a Redis-backed session store initiates a WebAuthn authentication ceremony for a known username. By manipulating the ceremony across session nodes - exploiting the inconsistency in user verification state replication - the attacker completes the ceremony without satisfying the user verification requirement, gaining an authenticated session as the targeted user. No public exploit code has been identified at time of analysis, but the network-accessible nature and complete authentication bypass outcome make this a high-value target for motivated threat actors.