Spring WebFlux Missing SameSite Cookie Attribute

CVE-2026-47889 affects Spring Framework versions 6.2.0-6.2.19 and 7.0.0-7.0.8, where WebFlux applications running on Jetty 12 Core serialize response cookies without the sameSite attribute. This omission creates a cross-site request forgery (CSRF) vulnerability, allowing attackers to bypass same-site cookie protections that modern browsers enforce. Organizations running affected Spring Framework versions in production environments are at risk, particularly those handling sensitive operations through web applications where session hijacking or unauthorized state-changing requests could occur. The vulnerability has a CVSS score of 7.5 (high), reflecting its significant impact on application security posture.

While Casky's current skill library shows 0 direct matches for this CVE, practitioners using Casky's Claude-powered analysis would detect attack patterns associated with cookie manipulation and session-based attacks mapped to MITRE ATT&CK techniques like T1539 (Steal Web Session Cookie) and T1548 (Abuse Elevation Control Mechanism). Security teams examining logs from affected applications would identify suspicious cross-origin requests that successfully modify state, anomalous session activity patterns, or failed CSRF token validations. By running extended reasoning against the 754 mapped security skills, Casky would help practitioners correlate these observations with the underlying cookie serialization issue, guiding them toward patching Spring Framework to versions 6.2.20+ or 7.0.9+ and implementing explicit sameSite=Strict configurations as interim mitigations.