CVE-2026-41839: Spring Framework Privilege Escalation

CVE-2026-41839 Overview

CVE-2026-41839 is a session fixation vulnerability [CWE-384] affecting Spring Framework WebFlux applications. An attacker who compromises a subdomain, for example through a cross-site scripting (XSS) flaw, can exchange a known session ID for that of an authenticated user. This enables privilege escalation by hijacking authenticated sessions across sibling subdomains sharing a cookie scope.

Affected Spring Framework versions span 7.0.0 through 7.0.7, 6.2.0 through 6.2.18, 6.1.0 through 6.1.27, and 5.3.0 through 5.3.48. The vulnerability requires user interaction and high attack complexity, limiting practical exploitation to environments where a sibling subdomain is already compromised.

Critical Impact
An attacker controlling a sibling subdomain can promote a known session identifier to an authenticated user's session, gaining unauthorized access to that user's account on a Spring WebFlux application.

Affected Products

Spring Framework 7.0.0 through 7.0.7
Spring Framework 6.2.0 through 6.2.18, and 6.1.0 through 6.1.27
Spring Framework 5.3.0 through 5.3.48

Discovery Timeline

2026-06-09 - CVE-2026-41839 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-41839

Vulnerability Analysis

The vulnerability resides in how Spring WebFlux handles session identifiers during authentication state changes. When a user authenticates, the framework does not consistently invalidate the pre-authentication session identifier and issue a new one bound to the authenticated principal. An attacker who pre-plants a known session ID through a compromised subdomain can later observe that same identifier becoming attached to an authenticated user's session.

Because cookies are commonly scoped to a parent domain, a compromised subdomain can write cookies that the target WebFlux application reads. The attacker uses an XSS foothold on the sibling subdomain to set the victim's session cookie to a value the attacker already knows. After the victim authenticates, the attacker reuses that session ID to access the victim's authenticated context.

Root Cause

The root cause is the absence of session ID rotation on authentication. Per [CWE-384], applications must invalidate any prior session identifier when a user's privilege level changes and issue a fresh, unpredictable identifier. Spring WebFlux's session handling in the affected versions preserves the inbound session token across authentication boundaries, enabling the fixation pattern.

Attack Vector

Exploitation requires three preconditions. First, the attacker compromises a sibling subdomain, typically through XSS, to write cookies into the parent domain scope. Second, the attacker plants a known session identifier into the victim's browser for the target WebFlux application. Third, the victim authenticates to the target application while the attacker-controlled session cookie is present. After authentication, the attacker replays the known session ID and inherits the victim's authenticated session.

The vulnerability mechanics are documented in the Spring Security advisory for CVE-2026-41839. No public proof-of-concept exploit is available.

Detection Methods for CVE-2026-41839

Indicators of Compromise

Session identifiers that persist unchanged across login events for the same user.
Multiple concurrent active sessions sharing one session ID across distinct source IP addresses or user agents.
Cookie write operations to the parent domain originating from unexpected subdomains.

Detection Strategies

Audit Spring WebFlux application logs for authentication events and compare the inbound SESSION cookie before and after login to identify cases where the identifier is not rotated.
Correlate XSS detections on subdomains with subsequent authentication events on the primary WebFlux application to surface fixation attempts.
Inspect web application firewall logs for Set-Cookie headers targeting the application's session cookie from non-application origins.

Monitoring Recommendations

Monitor authentication services for reuse of session identifiers that predate the authentication event.
Enable verbose session lifecycle logging on WebFlux WebSessionManager to record creation, mutation, and invalidation events.
Alert on cross-subdomain cookie writes targeting the production application's session cookie name.

How to Mitigate CVE-2026-41839

Immediate Actions Required

Upgrade Spring Framework to a patched release per the Spring Security advisory.
Remediate XSS vulnerabilities on all subdomains that share a cookie scope with the WebFlux application.
Scope session cookies with the Host- prefix or to the exact application host to prevent sibling subdomains from writing them.

Patch Information

Upgrade to Spring Framework 7.0.8 or later for the 7.0.x line, 6.2.19 or later for the 6.2.x line, 6.1.28 or later for the 6.1.x line, and 5.3.49 or later for the 5.3.x line. Refer to the Spring Security advisory for the authoritative patched version matrix.

Workarounds

Enforce session identifier rotation on authentication by invalidating the inbound WebSession and creating a new one in the authentication success handler.
Set the session cookie name with a __Host- prefix and Path=/ without a Domain attribute to prevent subdomain cookie injection.
Apply a strict Content Security Policy across all subdomains to reduce the XSS surface that enables this attack.

bash

# Configuration example: harden session cookie scope in application.yaml
server:
  reactive:
    session:
      cookie:
        name: __Host-SESSION
        http-only: true
        secure: true
        same-site: lax
        path: /