## cve-2026-47841 - HIGH - WebAuthn User Verification Bypass via Session Serialization

- 種別: advisory
- 重大度: high
- 関連技術: spring, java, redis
- CVE: CVE-2026-47841
- 公開日時: 2026-08-20T00:00:00.000Z
- 情報源: Spring Security Advisories (https://spring.io/security/cve-2026-47841)
- パーマリンク: https://vulnpulse.app/items/spring-security-4bf91ea50997

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security compares UserVerificationRequirement using identity ( == ) when determining whether user verification is required during a WebAuthn ceremony. When HTTP sessions are serialized and deserialized, as occurs with distributed session stores (e.g., Spring Session with Redis or JDBC), the deserialized UserVerificationRequirement instance is not the same object reference as the static constant REQUIRED . The identity comparison evaluates to…