Medium

Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

Disclosed: 10.06.2026
Updated: 11.10.2026 13:20

In Spring Security Web, SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.

SubjectDnX509PrincipalExtractor is deprecated by this CVE and replaced with SubjectX500PrincipalExtractor. As part of updating, you should also migrate to SubjectX500PrincipalExtractor.

Affected versions: Spring Security Enterprise 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10. OSS 6.5.0 through 6.5.10.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Java / Kotlin (Maven)	org.springframework.security:spring-security-web	>= 6.5.0, < 6.5.11, >= 6.4.0, <= 6.4.13, >= 6.0.0, <= 6.3.10, >= 5.8.0, <= 5.8.16, <= 5.7.14	6.5.11

References

CVSS score 6.8/10

CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-287
Platform: Java / Kotlin (Maven)
Package: org.springframework.security:spring-security-web
Disclosed: 10.06.2026
Updated: 11.10.2026 13:20

Sources and licenses

OSV / GitHub Advisory Database - GHSA-293q-567p-wmwq - CC BY 4.0

Vulnerability history: org.springframework.security:spring-security-web

All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 7
First → latest: 05.2021 06.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

Critical 3
High 1
Medium 3

Disclosures per year

2021: 1
2022: 1
2023: 0
2024: 1
2025: 0
2026: 4

10.06.2026

Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates this entry

Medium · 6.8 CVE-2026-47838 >= 6.5.0, < 6.5.11, >= 6.4.0, <= 6.4.13, >= 6.0.0, <= 6.3.10, >= 5.8.0, <= 5.8.16, <= 5.7.14 6.5.11
10.06.2026

Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache

Medium · 6.1 CVE-2026-41706 >= 7.0.0, < 7.0.6, >= 6.5.0, < 6.5.11, >= 6.3.0, <= 6.3.16, >= 5.8.0, <= 5.8.25, <= 5.7.23 7.0.6, 6.5.11
22.04.2026

Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

Medium · 6.8 CVE-2026-22747 >= 7.0.0, < 7.0.5 7.0.5
20.03.2026

Spring Security HTTP Headers Are not Written Under Some Conditions

Critical · 9.1 CVE-2026-22732 <= 5.7.14, >= 5.8.0, <= 5.8.16, >= 6.0.0, <= 6.3.10, >= 6.4.0, <= 6.4.13, >= 6.5.0, < 6.5.9, >= 7.0.0, < 7.0.4 6.5.9, 7.0.4
28.10.2024

Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

Critical · 9.1 CVE-2024-38821 >= 5.0.0, < 5.7.13, >= 5.8.0, < 5.8.15, >= 6.2.0, < 6.2.7, >= 6.0.0, < 6.0.13, >= 6.1.0, < 6.1.11, >= 6.3.0, < 6.3.4 5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4
20.05.2022

Authorization bypass in Spring Security

Critical · 9.8 CVE-2022-22978 >= 5.5.0, < 5.5.7, >= 5.6.0, < 5.6.4, < 5.4.11 5.5.7, 5.6.4, 5.4.11
10.05.2021

Privilege escalation in spring security

High · 8.8 CVE-2021-22112 >= 5.4.0, < 5.4.4, >= 5.3.0, < 5.3.8, < 5.2.9 5.4.4, 5.3.8, 5.2.9

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application