A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. The omission removes a key protection that restricts cross‑domain visibility of cookies, enabling attackers to craft cross‑site requests that could exploit stateful operations without user interaction. This constitutes a weakness that can lead to user‑credential theft or unauthorized actions if the application is not otherwise CSRF protected.

Spring Framework versions 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19 are affected. Any Spring WebFlux deployment on Jetty 12 Core that relies on the default cookie serializer will exhibit this behavior.

EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is unspecified, but the missing SameSite attribute is a commonly exploited vector for CSRF attacks. While no public exploits are documented, the potential impact is considerable for applications that rely on cookie‑based authentication and do not implement additional CSRF safeguards. The likely attack vector is a remote attacker crafting cross‑site requests; this inference is based on the nature of the cookie omission.