This vulnerability (CVE-2026-41839) in Spring Framework's WebFlux module allows an attacker who has compromised a subdomain (for example, via cross-site scripting) to perform a session fixation attack. The attacker can cause an authenticated user to use a session ID known to the attacker, potentially enabling escalation of privileges or unauthorized access. The affected versions span multiple major releases of Spring Framework: 5.3.0 to 5.3.48, 6.1.0 to 6.1.27, 6.2.0 to 6.2.18, and 7.0.0 to 7.0.7. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability. No vendor advisory or patch links are currently available, and the remediation level is unspecified.

The vulnerability allows an attacker with control over a subdomain to fixate a session ID for an authenticated user, potentially enabling the attacker to hijack or escalate privileges within the application session. The impact is limited to confidentiality and integrity with low severity, and no impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor Spring Framework vendor communications for updates. In the meantime, mitigating the risk of subdomain compromise (e.g., preventing XSS) and implementing additional session management controls may reduce exposure.