CVE-2026-41839

A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Scoring

Severity

MEDIUM

CVSS base score

4.2

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS probability

0.21%

CWE

CWE-384

Published

2026-06-09

Last modified

2026-06-23

Affected products

• Spring Spring Framework
• Spring Spring Framework
• Spring Spring Framework
• Spring Spring Framework

Weakness type

• CWE-384

Related vulnerabilities

• CVE-2026-64857 — tirreno has Session Fixation in Login Authentication
• CVE-2026-86674 — ningzichun Student Management System login.php session_start session fixiation
• CVE-2026-76196 — Photoshop Mobile | Session Fixation (CWE-384)
• CVE-2026-86279 — SourceCodester Syllabus-Aligned Learning Management & Examination System Login auth_process.php session fixiation
• CVE-2026-85238 — Session Fixation in MISP CustomAuth Authentication Allows Session Hijacking
• CVE-2026-18527 — IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [, ].
• CVE-2026-81826 — Flowintel Fails to Invalidate Active Sessions After Password Change
• CVE-2026-70594 — Ghost: Session Fixation in Ghost Admin

Markdown version · Browse all CVEs