Executive brief
Spring Framework's WebFlux reactive adapter for Jetty 12 fails to include the SameSite attribute when setting response cookies. This omission allows browsers to send cookies with cross-site requests, potentially enabling attackers to exploit cross-site request forgery (CSRF) attacks and compromise user sessions across applications relying on cookies for authentication.
Technical details
The vulnerability exists in Spring Framework's WebFlux implementation when running on the Jetty 12 Core reactive adapter. Response cookies are serialized without the SameSite attribute, a security-critical flag that restricts cookie transmission to same-origin requests. This allows cookies to be sent with cross-site requests, increasing exposure to CSRF attacks. The issue affects Spring Framework versions 6.2.0–6.2.19 and 7.0.0–7.0.8. Applications using WebFlux with Jetty 12 adapter are vulnerable; remediation requires upgrading to a patched version or explicitly configuring SameSite attributes in the application.
Affected products
- Spring Framework 6.2.0 to 6.2.19, 7.0.0 to 7.0.8
Timeline
- 2026-08-27: disclosed