CVEvulnerability

CVE-2026-47838

8.1 HIGH Published 2026-06-10 Modified 2026-07-23 Official page ↗
Status
Analyzed
Published
2026-06-10
Last modified
2026-07-23
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-287

Description

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.

Affected configurations

• vmware spring security (< 5.7.25) • vmware spring security (>= 5.8.0 < 5.8.27) • vmware spring security (>= 6.3.0 < 6.3.18) • vmware spring security (>= 6.4.0 < 6.4.18) • vmware spring security (>= 6.5.0 < 6.5.11)

Related

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References