An application using Spring Security's WebAuthn support may be vulnerable to user verification bypass when using a distributed HTTP session store.

Spring Security compares UserVerificationRequirement using identity (==) when determining whether user verification is required during a WebAuthn ceremony. When HTTP sessions are serialized and deserialized, as occurs with distributed session stores (e.g., Spring Session with Redis or JDBC), the deserialized UserVerificationRequirement instance is not the same object reference as the static constant REQUIRED. The identity comparison evaluates to false, silently disabling the user verification requirement.

An application is vulnerable when all of the following conditions are met:

• The application uses WebAuthn (passkey) authentication.
• The application explicitly configures userVerification = REQUIRED (the default is PREFERRED and is not affected).
• The application uses a distributed HTTP session store such as Spring Session with Redis, JDBC, or Hazelcast.

When all the conditions above are met, an attacker who has obtained a user's authenticator device may be able to complete WebAuthn authentication without satisfying the user verification step (e.g., PIN or biometric), even when the relying party has explicitly required it.