CVE-2026-47841— WebAuthn User Verification Bypass via Session Serialization
Quick assessment
Affected
Spring Spring Security
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
VMware Spring Security是美国VMware公司开源的一套为Spring应用提供安全保护的安全框架。 VMware Spring Security 7.1.0版本、7.0.0至7.0.6版本、6.5.0至6.5.11版本和6.4.0至6.4.18版本存在授权问题漏洞，该漏洞源于使用分布式HTTP会话存储时用户验证绕过问题，可能导致攻击者绕过用户验证。
Possible ATT&CK Techniques 1 AI
T1078 · Valid AccountsAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Spring | Spring Security | 7.1.0 |
affected |
7.0.0≤ 7.0.6 |
affected | ||
6.5.0≤ 6.5.11 |
affected | ||
6.4.0≤ 6.4.18 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-47841
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WebAuthn User Verification Bypass via Session Serialization
Source: CVE Program / CVE List V5
Vulnerability Description
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store.
Spring Security 7.1.0
Spring Security 7.0.0 - 7.0.6
Spring Security 6.5.0 - 6.5.11
Spring Security 6.4.0 - 6.4.18
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
VMware Spring Security 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VMware Spring Security是美国VMware公司开源的一套为Spring应用提供安全保护的安全框架。 VMware Spring Security 7.1.0版本、7.0.0至7.0.6版本、6.5.0至6.5.11版本和6.4.0至6.4.18版本存在授权问题漏洞，该漏洞源于使用分布式HTTP会话存储时用户验证绕过问题，可能导致攻击者绕过用户验证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Spring Security | 7.1.0 | - |
|
II. Public POCs for CVE-2026-47841
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47841
请登录查看更多情报信息。
Vendor Pages for CVE-2026-47841 (1)
Same Patch Batch · Spring · 2026-08-26 · 20 CVEs total
| CVE-2026-47852 | 7.5 HIGH | Predictable cache directory location allows local ONNX model substitution in Spring AI |
| CVE-2026-47851 | 7.5 HIGH | Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Re |
| CVE-2026-47836 | 7.2 HIGH | Spring Cloud Config Server Susceptible To TOCTOU Attack When Using SVN |
| CVE-2026-47837 | 6.8 MEDIUM | Spring Cloud Config Server Monitor Endpoint Does Not Validate Webhook Requests |
| CVE-2026-47842 | 6.5 MEDIUM | Deterministic AES/CBC Encryption in Spring Security AesBytesEncryptor Allows Ciphertext Co |
| CVE-2026-47860 | 6.5 MEDIUM | Unbounded decompression of attacker-supplied compressed message bodies |
| CVE-2026-47861 | 6.3 MEDIUM | UDP adapter sends ack to attacker-supplied host:port parsed from packet body, even when ac |
| CVE-2026-47856 | 6.3 MEDIUM | JsonToObjectTransformer resolves the json__TypeId__ message header to an arbitrary class w |
| CVE-2026-47848 | 6.1 MEDIUM | Reactor Netty WebSocket Client Leaks Credentials On Redirect |
| CVE-2026-47863 | 5.9 MEDIUM | Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream deli |
| CVE-2026-47857 | 5.9 MEDIUM | Reactor Core windowTimeout fair-backpressure stream hang due to 20-bit index wrap-around |
| CVE-2026-47862 | 5.4 MEDIUM | ZipTransformer uses file_name header to build workDirectory path without sanitization |
| CVE-2026-47859 | 5.4 MEDIUM | Unbounded memory allocation in RFC6587SyslogDeserializer (octet-counted framing) — remote |
| CVE-2026-47844 | 5.3 MEDIUM | Reactor Netty HTTP Server Leaks Exception Details |
| CVE-2026-47845 | 5.3 MEDIUM | Reactor Netty HTTP Server may incorrectly evaluate proxy addresses |
| CVE-2026-47874 | 5.3 MEDIUM | Reactor Netty HTTP Server Denial of Service With Pipelined Requests |
| CVE-2026-47834 | 4.8 MEDIUM | Spring Data JPA Sort expression validation bypass |
| CVE-2026-47850 | 4.3 MEDIUM | Spring Data REST allows mutation of the version property of immutable aggregates via PUT |
| CVE-2026-47843 | 3.7 LOW | Reactor Netty may incorrectly route traffic due to DNS resolver reuse |
IV. Related Vulnerabilities
Same product: Spring Security
-
CVE-2026-59277
Spring Security InetAddressMatchers Incomplete Internal Netw -
CVE-2026-59276
Timing Attack via Non-Constant-Time Comparison of Sensitive -
CVE-2026-59270
Spring Security embedded UnboundID LDAP server exposes well- -
CVE-2026-47877
Spring Security Authorization Server Default Consent Page is -
CVE-2026-47842
Deterministic AES/CBC Encryption in Spring Security AesBytes
Same vendor: Spring
-
CVE-2026-59324
fluxTransform shared RequestMessageHolder causes cross-messa -
CVE-2026-59322
EmbeddedHeadersJsonMessageMapper default gives wire peer ful -
CVE-2026-59321
Shared JSR-223 ScriptEngine evaluated concurrently without T -
CVE-2026-59320
In Spring AMQP the link credit never replenished on listener -
CVE-2026-59319
RediSearch Tag Injection in RedisChatMemoryRepository Allows
V. Comments for CVE-2026-47841
No comments yet