A header predicate bypass in WebFlux functional endpoints enables an attacker to craft a pre‑flight request that is incorrectly accepted, effectively bypassing CORS restrictions. The attacker can then issue cross‑origin requests that the application would normally reject, potentially exposing sensitive data or allowing cross‑site request forgery. The weakness is an improper validation of header predicates, which can be used to gain unauthorized cross‑origin access to protected resources.

The vulnerability affects Spring Framework versions 5.2.5-RELEASE through 5.2.25-RELEASE, 5.3.0 through 5.3.49, 6.0.0 through 6.0.30, 6.1.0 through 6.1.28, 6.2.0 through 6.2.19, and 7.0.0 through 7.0.8. Products using functional endpoints with DispatcherServlet are at risk.

The CVSS score is 9.8, the EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, but its impact on cross‑origin requests suggests a potentially severe threat. The attack vector is remote, via crafted HTTP OPTIONS requests to the application’s endpoint, requiring the application to be exposed and to use the vulnerable functional endpoint configuration.