Executive brief
Spring Security's WebAuthn (passkey/biometric authentication) support contains a flaw that allows attackers to bypass user verification checks when applications use distributed HTTP session storage. This could allow an attacker to gain unauthorized access to user accounts without proper authentication, potentially compromising sensitive data and account integrity across enterprise applications relying on this authentication mechanism.
Technical details
This vulnerability is an authentication bypass in Spring Security's WebAuthn implementation affecting versions 6.4.0–6.4.18, 6.5.0–6.5.11, and 7.0.0–7.0.6 (patched in 7.1.0). The flaw exists in the user verification validation logic when applications use a distributed HTTP session store rather than in-memory sessions. An attacker can exploit this by manipulating or replaying WebAuthn authentication responses to bypass the verification check. The vulnerability requires network access to the authentication endpoint but does not require prior authentication. The attack may involve session replication across distributed infrastructure where verification state is not properly maintained. Patched versions are available in Spring Security 7.1.0 and later minor version releases of the 6.4 and 6.5 branches.
Affected products
- VMware Spring Security 6.4.0–6.4.18, 6.5.0–6.5.11, 7.0.0–7.0.6
Timeline
- 2026-08-26: disclosed