CLEANSTART-2026-UI84450: application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store

Q: Which deployments are exposed?

Exposure is limited to Rundeck deployments where the application uses Spring Security WebAuthn support together with a distributed HTTP session store. The provided data does not establish that deployments without both conditions are affected.

Q: Does exploitation require an authenticated account or user interaction?

The supplied vector indicates no privileges are required and no user interaction is required. It also rates attack complexity as high, but does not specify the conditions an attacker must satisfy.

Q: How can I determine whether my deployment may be affected?

Review whether your Rundeck application uses Spring Security's WebAuthn functionality and whether HTTP sessions are stored in a distributed session store. If both are in use, treat the deployment as potentially affected based on the available information.

Q: What is the likely security impact?

The vulnerability is rated high severity with high confidentiality and integrity impact and no availability impact in the supplied vector. The described issue is a bypass of WebAuthn user verification.

Published Nov 11, 2026

Updated

Security vulnerability affects the rundeck package. An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store.

Affected Software

2 affected componentsFixes available

cleanstart/rundeck<6.3.0-r0

6.3.0-r0

cleanstart/rundeck<6.1.0-r4

6.1.0-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.3.0-r0
Upgrade
Upgrade cleanstart/rundeck to a version that resolves this vulnerability.
Fixed in 6.1.0-r4

Event History

Nov 11, 2026

Advisory Published

via OSV·12:39 AM

Data Sourced

via OSV·12:39 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-47841

Frequently Asked Questions

Which deployments are exposed?

Exposure is limited to Rundeck deployments where the application uses Spring Security WebAuthn support together with a distributed HTTP session store. The provided data does not establish that deployments without both conditions are affected.

Does exploitation require an authenticated account or user interaction?

The supplied vector indicates no privileges are required and no user interaction is required. It also rates attack complexity as high, but does not specify the conditions an attacker must satisfy.

How can I determine whether my deployment may be affected?

Review whether your Rundeck application uses Spring Security's WebAuthn functionality and whether HTTP sessions are stored in a distributed session store. If both are in use, treat the deployment as potentially affected based on the available information.

What is the likely security impact?

The vulnerability is rated high severity with high confidentiality and integrity impact and no availability impact in the supplied vector. The described issue is a bypass of WebAuthn user verification.

CLEANSTART-2026-UI84450: application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require an authenticated account or user interaction?

How can I determine whether my deployment may be affected?

What is the likely security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require an authenticated account or user interaction?

How can I determine whether my deployment may be affected?

What is the likely security impact?