CLEANSTART-2026-QU78029 application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store

Security vulnerability affects the rundeck package. An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store...

Security Bulletin: Due to the use of Spring Security's WebAuthn, IBM Sterling Control Center is vulnerable to Incorrect Authorization (CVE-2026-47841)

Summary Spring Security's WebAuthn is used by IBM Sterling Control Center as part of dependency in spring-security-web-6.4.12.jar. Vulnerability Details CVEID:CVE-2026-47841 DESCRIPTION: An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when usi...

Improper Authentication

Spring Security is vulnerable to Improper Authentication. The vulnerability is due to user verification state not being properly maintained with a distributed HTTP session store, allowing an attacker to bypass WebAuthn user verification...

CVE-2026-47841

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18...

CVE-2026-47841: Undefined Security Weakness

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18...