CVE-2026-47841 in Spring Security
Summary
by MITRE • 08/26/2026
An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in Spring Security's WebAuthn implementation represents a critical authentication bypass flaw that arises specifically within distributed session management architectures. When an application relies on a shared or distributed HTTP session store to maintain state across multiple server instances, the integrity of the user verification process during WebAuthn operations can be compromised. This issue affects several versions of the Spring Security framework, including 7.1.0 and earlier releases in the 6.x and 7.0 series up to their respective patch levels. The core of the problem lies in how session data is synchronized and validated across nodes when handling the complex handshake required for WebAuthn authentication flows.
WebAuthn relies on a challenge-response mechanism where the server generates a cryptographic challenge that must be signed by the user's authenticator using a private key stored securely within hardware or software tokens. The server then verifies this signature against public keys previously registered to the user account. In environments utilizing distributed session stores, such as Redis clusters or database-backed session managers, there exists a race condition and state synchronization gap during the authentication transaction. Specifically, the verification of whether the user has been verified by their authenticator is not consistently enforced across all nodes involved in processing the request. This allows an attacker to manipulate the flow such that the system accepts an unverified credential as valid because one node may proceed with session creation or token issuance before another node can enforce the strict requirement for user verification status.
The operational impact of this vulnerability is severe, effectively nullifying a primary security benefit of WebAuthn: strong user presence and consent assurance. By bypassing the user verification step, an attacker who has obtained or stolen a registered public key credential could potentially authenticate as that user without possessing the physical authenticator or triggering its biometric or PIN requirements. This undermines the non-repudiation guarantees provided by FIDO2 standards and exposes applications to unauthorized access even when multi-factor authentication is ostensibly enabled via WebAuthn. The risk is particularly acute in high-availability setups where request routing may direct different parts of an authentication transaction to different backend servers, exacerbating the state inconsistency that leads to the bypass.
This flaw aligns with CWE-287, which describes Improper Authentication, and specifically relates to weaknesses in handling session management during multi-factor or public key-based login sequences. From a MITRE ATT&CK perspective, this vulnerability facilitates Account Manipulation and potentially Initial Access through credential theft combined with protocol exploitation techniques that bypass intended security controls. It highlights the dangers of assuming atomicity and consistency in distributed systems when dealing with critical authentication state transitions.
To mitigate this risk, organizations must upgrade to patched versions of Spring Security where these session synchronization issues have been resolved. For applications running on affected versions such as 6.4.x through 6.5.11 or 7.0.x through 7.0.6 and the specific instance in version 7.1.0, immediate patching is required to restore proper enforcement of user verification checks across distributed environments. Additionally, developers should review their session configuration strategies, ensuring that critical authentication state changes are handled with strict consistency guarantees or by utilizing sticky sessions for WebAuthn endpoints during the transaction lifecycle until all infrastructure components can be updated. Monitoring logs for anomalies in login patterns and verifying that authenticator data is consistently validated against user verification flags across all cluster nodes provides an additional layer of defense while patching efforts are underway.