Description

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-26T18:16:33.303Z",
  "pubdate": "2026-08-26T18:16:33.303Z",
  "executiveSummary": "A critical security vulnerability exists in Spring Security's WebAuthn support, specifically affecting configurations that utilize distributed HTTP session stores.\nThe vulnerability manifests as a user verification bypass, enabling unauthorized authentication state manipulation.\nImpacted versions include Spring Security 7.1.0, 7.0.0 through 7.0.6, 6.5.0 through 6.5.11, and 6.4.0 through 6.4.18.\nThe flaw stems from improper handling of WebAuthn authentication state within distributed session environments, which may allow an attacker to circumvent mandatory user verification requirements.\nThis presents significant risk to authentication integrity, as an attacker with the ability to influence or predict session data across distributed nodes could bypass critical security controls.\nSuccessful exploitation requires the deployment of a distributed session store and sufficient interaction with the authentication flow to manipulate the stored session state.\nThis vulnerability compromises the trust model of WebAuthn, potentially leading to unauthorized account access without fulfilling legitimate second-factor or biometric verification criteria.",
  "technicalDetails": "The root cause of this vulnerability lies in the race conditions or synchronization issues present when managing WebAuthn authentication state in a distributed HTTP session architecture.\nIn a standard WebAuthn flow, the server generates a challenge and stores it in the session to ensure the subsequent assertion returned by the client matches the initial request. When using a distributed session store (e.g., Redis, Hazelcast), the synchronization of this state between the node generating the challenge and the node validating the assertion is critical.\nThe vulnerability occurs because the logic responsible for checking user verification flags—specifically those pertaining to the WebAuthn 'uv' (User Verified) parameter—may not correctly reconcile or enforce the state across nodes in a distributed environment.\nIf the application relies on session state to determine if user verification was successfully performed during the initial challenge-response exchange, an attacker may exploit inconsistencies in the distributed store to influence the validation logic.\nThe attack flow proceeds as follows: First, an attacker initiates a legitimate authentication request, prompting the application to store the WebAuthn challenge and expected verification status in the distributed session. Second, before the server validates the final assertion, the attacker may attempt to manipulate the session state or leverage synchronization delays between nodes to force the application to treat an improperly verified authentication attempt as successfully verified.\nThis bypasses the cryptographically bound assertion verification process that enforces user presence and verification (biometric or PIN).\nBecause the validation logic improperly trusts the session-stored verification status in distributed environments, it fails to independently re-verify the assertion's 'uv' flag against the actual credential data, effectively ignoring the security policy defined by the Relying Party.\nAffected versions include 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, and 6.4.0-6.4.18. The vulnerability necessitates a distributed session backend and is accessible remotely via standard web-based authentication workflows. Post-exploitation, an attacker can successfully authenticate as a victim user without providing the requisite second-factor verification, bypassing intended security posture."
}