CVE-2026-41839

Name of the Vulnerable Software and Affected Versions Spring Framework versions 7.0.0 through 7.0.7 Spring Framework versions 6.2.0 through 6.2.18 Spring Framework versions 6.1.0 through 6.1.27 Spring Framework versions 5.3.0 through 5.3.48

Description A WebFlux application with a compromised subdomain, such as one compromised via cross-site scripting (XSS), is susceptible to an escalation attack. This allows an attacker to exchange a known session ID for that of an authenticated user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.