CVE-2026-47841

Analyzed Analyzed - Analysis Complete

Authentication Bypass in Spring Security WebAuthn

Publication date: 2026-08-26

Last updated on: 2026-09-04

Assigner: VMware

Description

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-26

Last Modified

2026-09-04

Generated

2026-09-16

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-14

NVD

CVE-2026-47841

EUVD

EUVD-2026-66639

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	spring_security	From 6.5.0 (inc) to 6.5.12 (exc)
vmware	spring_security	From 6.4.0 (inc) to 6.4.19 (exc)
vmware	spring_security	From 7.1.0 (inc) to 7.1.0.1 (exc)
vmware	spring_security	From 7.0.0 (inc) to 7.0.6.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is a WebAuthn user verification bypass affecting Spring Security versions 7.1.0 to 7.1.0, 7.0.0 to 7.0.6, 6.5.0 to 6.5.11, and 6.4.0 to 6.4.18. It occurs when applications use WebAuthn authentication with user verification set to REQUIRED and rely on a distributed HTTP session store. Due to session serialization issues, Spring Security incorrectly compares UserVerificationRequirement objects using identity instead of value, disabling user verification requirements. This allows attackers with access to a user's authenticator device to bypass verification like PIN or biometrics.

Detection Guidance

To detect this vulnerability, check if your system uses Spring Security versions 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, or 6.4.0-6.4.18 with WebAuthn and a distributed HTTP session store. Inspect application logs for WebAuthn authentication attempts and verify if user verification requirements are enforced.

Impact Analysis

Attackers with access to a user's authenticator device could bypass required user verification steps such as PIN or biometric checks. This undermines the security of WebAuthn authentication, potentially allowing unauthorized access to sensitive accounts or data. Systems relying on strict user verification for compliance or security may be compromised.

Compliance Impact

This vulnerability could impact compliance with regulations requiring strong authentication like GDPR's data protection principles or HIPAA's security requirements for protected health information. Bypassing user verification may lead to unauthorized access, violating regulatory obligations for access control and data protection.

Mitigation Strategies

Upgrade to fixed versions: Spring Security 7.1.1 (OSS), 7.1.0.1 (Enterprise), 7.0.7 (OSS), 7.0.6.1 (Enterprise), 6.5.12 (Enterprise), or 6.4.19 (Enterprise). No additional mitigation steps are required after upgrading.

Hi! I’m here to help you understand CVE-2026-47841. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70