What is GHSA-326h-rh66-6gp9?

GHSA-326h-rh66-6gp9 is a security advisory published by GitHub Security Advisories with High severity. An application using Spring Security's WebAuthn support may be vulnerable to user verification...

Which CVE IDs does GHSA-326h-rh66-6gp9 cover?

GHSA-326h-rh66-6gp9 covers the following CVE IDs: CVE-2026-47841. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-326h-rh66-6gp9?

GHSA-326h-rh66-6gp9 has a CVSS v3 base score of 7.4, published by GitHub Security Advisories.

GHSA-326h-rh66-6gp9HighCVSS 7.4

An application using Spring Security's WebAuthn support may be vulnerable to user verification...

Vendor

GitHub Security Advisories

Published

August 26, 2026

Last Modified

August 26, 2026

🔗 CVE IDs covered (1)

CVE-2026-47841 →

📋 Description

An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-47841
https://spring.io/security/cve-2026-47841
https://github.com/advisories/GHSA-326h-rh66-6gp9