CVE-2026-47889: CWE-1275 Sensitive Cookie with Improper SameSite Attribute in Spring Spring Framework

This vulnerability (CVE-2026-47889) affects Spring Framework versions 7.0.0 to 7.0.8 and 6.2.0 to 6.2.19. It occurs because a WebFlux application using the Jetty 12 Core reactive adapter serializes response cookies without including the SameSite attribute. The SameSite attribute is a security control that restricts how cookies are sent with cross-site requests, helping to prevent CSRF attacks. The absence of this attribute on sensitive cookies can allow them to be sent in unintended cross-origin contexts, increasing the risk of session hijacking or unauthorized actions. The CVSS v3.1 base score is 7.5, indicating high severity, with network attack vector, low complexity, no privileges or user interaction required, and high confidentiality impact but no integrity or availability impact. There is no vendor advisory or patch information currently available.

The vulnerability allows sensitive cookies to be transmitted without the SameSite attribute, which can enable attackers to perform cross-site request forgery attacks by leveraging the browser's cookie handling in cross-origin requests. This can lead to unauthorized disclosure of sensitive session information (confidentiality impact). There is no direct impact on integrity or availability. The attack can be performed remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing additional CSRF protections at the application level or configuring cookies manually with the SameSite attribute where possible. Monitor official Spring Framework advisories for updates.