Quick answers
- Is CVE-2026-47841 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-47841 being exploited in the wild.
- How severe is CVE-2026-47841?
- High severity, with a CVSS score of 7.4, published 26 August 2026.
- Which products and versions are affected?
- VMware Spring Security 6.4.0–6.4.18, 6.5.0–6.5.11, 7.0.0–7.0.6.
- Is there a fix for CVE-2026-47841?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-47841 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-47841?
- Check whether you run VMware Spring Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This vulnerability is an authentication bypass in Spring Security's WebAuthn implementation affecting versions 6.4.0–6.4.18, 6.5.0–6.5.11, and 7.0.0–7.0.6 (patched in 7.1.0). The flaw exists in the user verification validation logic when applications use a distributed HTTP session store rather than in-memory sessions. An attacker can exploit this by manipulating or replaying WebAuthn authentication responses to bypass the verification check. The vulnerability requires network access to the authentication endpoint but does not require prior authentication. The attack may involve session replication across distributed infrastructure where verification state is not properly maintained. Patched versions are available in Spring Security 7.1.0 and later minor version releases of the 6.4 and 6.5 branches.
Affected products
- VMware Spring Security 6.4.0–6.4.18, 6.5.0–6.5.11, 7.0.0–7.0.6
Timeline
- 2026-08-26: disclosed