CVE-2026-47841: Spring Security WebAuthn Auth Bypass Flaw

CVE-2026-47841 is an authentication bypass vulnerability in Spring Security's WebAuthn support affecting distributed HTTP session stores. Attackers can bypass user verification to gain unauthorized access. This article covers technical details, affected versions from 6.4.0 to 7.1.0, security impact, and mitigation strategies.

CVE-2026-47841 Overview

CVE-2026-47841 affects applications using Spring Security's WebAuthn support when configured with a distributed HTTP session store. The flaw allows an attacker to bypass user verification, undermining a core assurance of the WebAuthn authentication protocol. Spring Security is the de facto authentication and authorization framework for Java Spring applications, making the exposure surface broad across enterprise deployments.

The issue is tracked in the Spring Security Advisory CVE-2026-47841 and impacts multiple maintained release branches.

Critical Impact
Attackers can bypass WebAuthn user verification checks in applications backed by distributed session stores, weakening authentication assurance and potentially enabling account takeover.

Affected Products

Spring Security 7.1.0
Spring Security 7.0.0 through 7.0.6
Spring Security 6.5.0 through 6.5.11 and 6.4.0 through 6.4.18

Discovery Timeline

2026-08-26 - CVE-2026-47841 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-47841

Vulnerability Analysis

Spring Security's WebAuthn support validates authenticator assertions during login and step-up authentication flows. When an application uses a distributed HTTP session store, such as Redis or Hazelcast, session state is serialized across nodes rather than held in memory on a single instance. The user verification (UV) flag carried in the WebAuthn assertion is not preserved correctly across this boundary, letting an attacker's assertion pass checks that should require verified user presence.

The network-reachable authentication attack path yields high impact to confidentiality and integrity when successfully exploited. Attack complexity is high because exploitation depends on the target application actually running a distributed session backend and exposing WebAuthn flows.

Root Cause

The root cause is an authentication logic flaw in the WebAuthn assertion handling path where user verification state is not consistently enforced after session data round-trips through a distributed store. The condition fits the pattern of Authentication Bypass and Broken Access Control tied to WebAuthn's UV requirement rather than a memory-safety defect.

Attack Vector

An unauthenticated remote attacker interacts with the WebAuthn endpoints of a vulnerable Spring application. By crafting or replaying assertion data that lacks a valid user verification signal, the attacker obtains an authenticated session that the application incorrectly treats as user-verified. See the Spring Security Advisory CVE-2026-47841 for protocol-level details.

No public proof-of-concept exploit code has been published for this issue.

Detection Methods for CVE-2026-47841

Indicators of Compromise

Successful WebAuthn authentications recorded without a corresponding user verification flag in application logs.
Repeated WebAuthn assertion submissions from the same client with anomalous flag combinations.
Session records in the distributed store showing authenticated principals whose associated assertion metadata is missing UV state.

Detection Strategies

Instrument Spring Security's WebAuthnAuthenticationProvider and assertion validators to emit structured audit events including the UV bit and origin.
Correlate authentication events with subsequent privileged actions to identify sessions that were promoted to sensitive scopes without verified user presence.
Compare authentication outcomes between application nodes to spot inconsistencies introduced by distributed session serialization.

Monitoring Recommendations

Forward Spring Security audit logs and Redis or Hazelcast session telemetry to a centralized analytics pipeline for correlation.
Alert on WebAuthn logins that reach step-up-protected endpoints without a recent verified-user event.
Track version strings of spring-security-web and spring-security-webauthn in your software bill of materials to confirm patched builds are in production.

How to Mitigate CVE-2026-47841

Immediate Actions Required

Inventory all Java applications using Spring Security WebAuthn together with a distributed HTTP session store.
Upgrade to a fixed Spring Security release on the 6.4.x, 6.5.x, 7.0.x, or 7.1.x branch as directed in the vendor advisory.
Invalidate active sessions in the distributed session store after upgrading to force re-authentication.

Patch Information

Remediation is available through Spring Security maintenance releases on the affected 6.4, 6.5, 7.0, and 7.1 branches. Consult the Spring Security Advisory CVE-2026-47841 for the exact fixed versions and upgrade guidance.

Workarounds

Temporarily revert to a non-distributed session store, such as in-memory sessions on a single node with sticky routing, until patches are deployed.
Enforce user verification server-side by rejecting WebAuthn assertions whose parsed UV flag is not true, independent of session-cached state.
Require an additional factor for sensitive operations to reduce the value of a bypassed WebAuthn verification.

bash

# Example Maven upgrade snippet - replace with the fixed version from the vendor advisory
mvn versions:set-property -Dproperty=spring-security.version -DnewVersion=<FIXED_VERSION>
mvn -U clean verify