CVE-2026-47841: CWE-287 Improper Authentication in Spring Spring Security

This vulnerability (CVE-2026-47841) involves improper authentication in Spring Security's WebAuthn implementation. Specifically, applications using distributed HTTP session stores with Spring Security's WebAuthn support may be vulnerable to user verification bypass. The affected versions include 6.4.0 through 6.4.18, 6.5.0 through 6.5.11, 7.0.0 through 7.0.6, and exactly 7.1.0. The CVSS v3.1 base score is 7.4, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. There is no vendor advisory or patch link provided, and the remediation level is not specified.

Successful exploitation could allow an attacker to bypass user verification in affected Spring Security WebAuthn implementations, potentially leading to unauthorized access and compromise of confidentiality and integrity of the application. Availability impact is not indicated. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider avoiding configurations that use distributed HTTP session stores with WebAuthn support or implement additional compensating controls to mitigate authentication bypass risks.