GitHub Advisoryadvisory · Maven

GHSA-2jrg-rf5x-568g Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates

MEDIUM Published 2026-04-22 Modified 2026-04-29 Official page ↗
Aliases
CVE-2026-22747
Ecosystem
Maven
Packages
org.springframework.security:spring-security-web
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-297
Reviewed
2026-04-29

Affected packages

• Maven org.springframework.security:spring-security-web: >= 7.0.0, < 7.0.5 → fixed in 7.0.5

Description

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.

Related

Alias · CVE (1)

  • CVE-2026-22747 Vulnerability in Spring Spring Security. vulnerability

Weakness · CWE (1)

  • CWE-297 Improper Validation of Certificate with Host Mismatch weakness

References