CVE Watch14 jul 2026

CVE-2026-41839

A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation

CVSS

4.2

Medio

EPSS

0.2%

p10

KEV

—

Exploit Today

0-100

Publicado: 9 jun 2026 · Última mod.: 14 jul 2026 · CWE-384

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-06-302026-07-17

Descripción técnica

A WebFlux application with a compromised subdomain (for example, compromised via cross-site scripting (XSS)) is vulnerable to an escalation attack exchanging a known session ID for that of an authenticated user. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3.0 through 5.3.48.

Referencias oficiales

spring.iohttps://spring.io/security/cve-2026-41839

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2022-273058.8 ALT

53.9%

——16Gibbon v23 does not generate a new session ID cookie after a user authenticates, making the application vulnerable to session fixation.9d CVE-2024-236799.8 CRÍ

53.7%

——16Enonic XP versions less than 7.7.4 are vulnerable to a session fixation issue. An remote and unauthenticated attacker can use prior sessions due to the lack of invalidating session attributes.3d CVE-2023-300567.5 ALT

49.9%

——15A session takeover vulnerability exists in FICO Origination Manager Decision Module 4.8.1 due to insufficient protection of the JSESSIONID cookie.9d CVE-2025-459499.8 CRÍ

34.5%

——10A critical vulnerability was found in PHPGurukul User Registration & Login and User Management System V3.3 in the /loginsystem/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely and leading to account takeover.13d CVE-2026-337579.6 CRÍ

33.3%

——10OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao does not prompt for user confirmation when logging in via JWT/OIDC and a role with `callback_mode` set to `direct`. This allows an attacker to start an authentication request and perform "remote phishing" by having the victim visit the URL and automatically log-in to the session of the attacker. Despite being based on the authorization code flow, the `direct` mode calls back directly to the API and allows an attacker to poll for an OpenBao token until it is issued. Version 2.5.2 includes an additional confirmation screen for `direct` type logins that requires manual user interaction in order to finish the authentication. This issue can be worked around either by removing any roles with `callback_mode=direct` or enforcing confirmation for every session on the token issuer side for the Client ID used by OpenBao.3d CVE-2025-459539.1 CRÍ

28.3%

——8A vulnerability was found in PHPGurukul Hostel Management System 2.1 in the /hostel/change-password.php file of the user panel - Change Password component. Improper handling of session data allows a Session Hijacking attack, exploitable remotely13d