CVE-2026-47848: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor in Spring Reactor Netty

This vulnerability involves the Reactor Netty WebSocket client leaking sensitive credentials when a WebSocket handshake is redirected to a different origin, but only if the HTTP client is explicitly configured to follow redirects. The affected versions include Reactor Netty 1.3.0 through 1.3.6, 1.1.0 through 1.2.18, and 1.0.52 and earlier. The CVSS 3.1 base score is 6.1, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity.

The vulnerability can lead to unauthorized exposure of sensitive information (credentials) during WebSocket handshake redirects to different origins if redirects are followed. This could allow an attacker to gain access to credentials that should remain confidential. There is no indication of impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling automatic redirect following in the HTTP client configuration to avoid credential leakage during WebSocket handshake redirects.