Spring Framework EUVD-2026-66857

Exploitation requires three concurrent conditions: (1) the Spring Framework application must use the WebFlux reactive stack - not the traditional Spring MVC servlet stack; (2) the WebFlux application must be configured to run on the Jetty 12 Core reactive adapter specifically, rather than the default Netty transport or Undertow; and (3) the application must issue cookies containing sensitive material (e.g., session identifiers, authentication tokens). Exploitation is further limited by the need for the victim user to be authenticated to the target application and to be socially engineered or redirected to an attacker-controlled cross-origin context. Deployments behind a reverse proxy that enforces SameSite via response-header rewriting are not exploitable even on affected versions. Non-default Jetty adapter configuration is the central constraining factor - the vast majority of WebFlux deployments use Netty and are unaffected.

The vendor-assigned CVSS of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) rates this as high severity, primarily driven by C:H and the fully open access metrics. However, several signals temper real-world priority. EPSS at 0.14% (4th percentile) reflects extremely low observed exploitation probability. SSVC characterizes exploitation as 'none' with only 'partial' technical impact, despite marking it 'automatable' - meaning tooling could systematically probe for the condition, but no exploitation infrastructure has been observed. The UI:N assignment in the NVD vector is questionable: cross-site cookie abuse inherently requires a victim user to visit an attacker-controlled page, which more accurately maps to UI:R. The C:H impact is realistic only if the affected application stores sensitive material (e.g., session tokens, auth cookies) in cookies and the attacker can successfully stage a cross-site scenario. Deployments using Jetty 12 Core as the reactive adapter are specifically affected; applications running on Netty (WebFlux default) or behind a reverse proxy that enforces SameSite via header injection are not exposed. Overall, this is a genuine architectural flaw worth patching in scheduled maintenance but does not warrant emergency response absent confirmed active exploitation.

An attacker hosts a malicious web page that, when visited by an authenticated user of a Spring WebFlux application running on Jetty 12 Core, issues a cross-origin request to the target application. Because the session cookie lacks a SameSite attribute, the browser automatically includes it in the cross-site request, allowing the attacker to perform actions on behalf of the authenticated user or, in certain browser configurations, observe the cookie value via Referer leakage. No public proof-of-concept exploit code has been identified at time of analysis; the scenario relies on standard browser cross-site mechanics and requires the victim to be authenticated and to visit the attacker-controlled page.