CVE-2026-47841 Spring CVE debrief

Who should care

Organizations using Spring Security in their applications, particularly those with WebAuthn support enabled and a distributed HTTP session store, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing their current Spring Security versions, assessing their exposure, and planning for updates or mitigations as necessary. Security teams and vulnerability management teams should prioritize this vulnerability for patching and monitoring due to its potential impact on user verification and authentication mechanisms.

Technical summary

A vulnerability in Spring Security's WebAuthn support may allow user verification bypass when using a distributed HTTP session store. This issue affects various versions of Spring Security, including 6.4.0-6.4.18, 6.5.0-6.5.11, 7.0.0-7.0.6, and 7.1.0. The vulnerability arises from improper handling of user verification in distributed environments, which could lead to unauthorized access if not properly mitigated. Organizations should prioritize patching affected versions to prevent potential user verification bypass attacks.

Defensive priority

Organizations using affected Spring Security versions should prioritize patching to prevent potential user verification bypass attacks.

Recommended defensive actions

• Apply patches for affected Spring Security versions
• Review and update inventory of Spring Security usage
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record indicates a vulnerability in Spring Security's WebAuthn support, potentially allowing user verification bypass when using a distributed HTTP session store. Affected versions include Spring Security 6.4.0-6.4.18, 6.5.0-6.5.11, 7.0.0-7.0.6, and 7.1.0. To verify, defenders should review the official CVE record and vendor advisory for accurate scope and mitigation guidance. Given the distributed nature of HTTP session stores, defenders should also assess their specific implementation for potential exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.