# CVE-2026-47841: Spring Security WebAuthn user verification bypass in distributed sessions

Source: https://junglewise.ai/threats/cve-2026-47841-spring-security-webauthn-user-verification-bypass-in-distributed  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-47841 · Severity: high · CVSS 7.4 · Published 2026-08-26

Spring Security's WebAuthn (passkey/biometric authentication) support contains a flaw that allows attackers to bypass user verification checks when applications use distributed HTTP session storage. This could allow an attacker to gain unauthorized access to user accounts without proper authentication, potentially compromising sensitive data and account integrity across enterprise applications relying on this authentication mechanism.

Technologies: [VMware Spring Security](https://junglewise.ai/threats/technologies/spring-security). Vendors: [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-47841 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47841 being exploited in the wild.

**How severe is CVE-2026-47841?** High severity, with a CVSS score of 7.4, published 26 August 2026.

**Which products and versions are affected?** VMware Spring Security 6.4.0–6.4.18, 6.5.0–6.5.11, 7.0.0–7.0.6.

**Is there a fix for CVE-2026-47841?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-47841 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47841?** Check whether you run VMware Spring Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an authentication bypass in Spring Security's WebAuthn implementation affecting versions 6.4.0–6.4.18, 6.5.0–6.5.11, and 7.0.0–7.0.6 (patched in 7.1.0). The flaw exists in the user verification validation logic when applications use a distributed HTTP session store rather than in-memory sessions. An attacker can exploit this by manipulating or replaying WebAuthn authentication responses to bypass the verification check. The vulnerability requires network access to the authentication endpoint but does not require prior authentication. The attack may involve session replication across distributed infrastructure where verification state is not properly maintained. Patched versions are available in Spring Security 7.1.0 and later minor version releases of the 6.4 and 6.5 branches.

## Affected products

- VMware Spring Security 6.4.0–6.4.18, 6.5.0–6.5.11, 7.0.0–7.0.6

## Timeline

- 2026-08-26: disclosed

## References

- [https://spring.io/security/cve-2026-47841](https://spring.io/security/cve-2026-47841)

## Related threats

- [Spring Security InetAddressMatchers IP classification bypass](https://junglewise.ai/threats/cve-2026-59277-spring-security-inetaddressmatchers-ip-classification-bypass)
- [Spring Security timing attack on security-sensitive string comparison](https://junglewise.ai/threats/cve-2026-59276-spring-security-timing-attack-on-security-sensitive-string)
- [Spring Security OAuth2 Authorization Server metadata validation in Dynamic Client Registration](https://junglewise.ai/threats/cve-2026-59354-spring-security-oauth2-authorization-server-metadata-validation)
- [Spring Security embedded UnboundID LDAP server authentication bypass](https://junglewise.ai/threats/cve-2026-59270-spring-security-embedded-unboundid-ldap-server-authentication)
- [VMware Spring Security user impersonation in SubjectDnX509PrincipalExtractor](https://junglewise.ai/threats/cve-2026-47838-vmware-spring-security-user-impersonation-in)