A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. The omission removes a key protection that restricts cross‑domain visibility of cookies, enabling attackers to craft cross‑site requests that could exploit stateful operations without user interaction. This constitutes a weakness that can lead to user‑credential theft or unauthorized actions if the application is not otherwise CSRF protected.

Spring Framework versions 7.0.0 through 7.0.8 and 6.2.0 through 6.2.19 are affected. Any Spring WebFlux deployment on Jetty 12 Core that relies on the default cookie serializer will exhibit this behavior.

EPSS score is <1% and the vulnerability is not listed in the CISA KEV catalog. The CVSS score of 7.5 indicates a high severity. The omission of the SameSite attribute is a commonly exploited vector for CSRF attacks. While no public exploits have been documented, the potential impact is significant for applications relying on cookie‑based authentication without additional CSRF protection. The likely attack vector is a remote attacker crafting cross‑site requests; this inference is based on the nature of the cookie omission.