This vulnerability (CVE-2026-41839) involves session fixation (CWE-384) in Spring Framework WebFlux applications. An attacker who compromises a subdomain, potentially through XSS, can fixate a session ID and escalate privileges by swapping it with an authenticated user's session ID. The affected versions include Spring Framework 5.3.0 through 5.3.48, 6.1.0 through 6.1.27, 6.2.0 through 6.2.18, and 7.0.0 through 7.0.7. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and low impact on confidentiality and integrity, with no impact on availability. The vendor has not yet published an official fix or remediation level, and no patch links are available.

An attacker who can compromise a subdomain (e.g., via XSS) may exploit this vulnerability to perform session fixation, allowing them to escalate privileges by exchanging a known session ID with that of an authenticated user. This could lead to unauthorized access to user sessions with limited impact on confidentiality and integrity. Availability is not affected. The overall impact is rated medium severity with a CVSS score of 4.2.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, consider mitigating risks related to subdomain compromises and XSS vulnerabilities, as these are prerequisites for exploitation.