Spring Security’s WebAuthn support may allow a user verification bypass when a distributed HTTP session store is used. The vulnerability description does not detail how the bypass occurs, but it implies that session data stored in a distributed store could potentially be tampered. Based on this description, it is inferred that an attacker who can modify the session payload might trick the framework into accepting it as verified without performing user verification, thereby gaining unauthorized access to protected resources.

Spring Security versions 7.1.0, 7.0.0‑7.0.6, 6.5.0‑6.5.11, and 6.4.0‑6.4.18 are affected. Any application that uses Spring Security’s WebAuthn support together with a distributed HTTP session store is vulnerable.

The CVSS score of 7.4 indicates high severity. The EPSS score is less than 1%, implying a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalogue. Based on the description, it is inferred that the attack vector involves remote manipulation of distributed session data, which would require an attacker to influence the session store—possible if the store is misconfigured or exposed. This makes the risk high for environments where session data may be tampered with, but the probability of widespread exploitation remains low at this time.