EUVD-2026-35911
GHSA-293q-567p-wmwq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable mTLS endpoint (AV:N, AC:L); attacker must hold a CA-signed client cert with controlled CN (PR:L); full impersonation yields C:H/I:H, no service disruption (A:N).
Primary rating from Vendor (vmware).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
7DescriptionNVD
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.
AnalysisAI
Authentication bypass via X.509 certificate impersonation in Spring Security affects versions 5.7.0-5.7.24, 5.8.0-5.8.26, 6.3.0-6.3.17, 6.4.0-6.4.17, and 6.5.0-6.5.10, where the SubjectDnX509PrincipalExtractor mishandles malformed Common Name (CN) values and resolves the principal to the wrong identity. An attacker holding a carefully crafted client certificate can authenticate as a different legitimate user, gaining their privileges. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Spring application has X.509 client-certificate authentication enabled and uses the default SubjectDnX509PrincipalExtractor (or any extractor that derives the username from the CN field of the Subject DN), and that the attacker can obtain a client certificate signed by a CA in the server's trust store with a CN field they control. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are mixed but converge on a moderate, not urgent, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker enrolls or obtains a client certificate from a CA the target server trusts, requesting a CN that embeds RDN-style separators or malformed sequences designed to be reparsed as a different username (for example, a victim administrator's identifier). The attacker then performs a normal mutual-TLS handshake against the Spring application; SubjectDnX509PrincipalExtractor extracts the crafted fragment instead of the true CN and Spring Security loads the victim's UserDetails, granting the attacker that user's roles. … |
| Remediation | Vendor-released patches are available: upgrade to Spring Security 5.7.25, 5.8.27, 6.3.18, 6.4.18, or 6.5.11 per your maintenance branch, as listed in the EUVD record and the Spring advisory at https://spring.io/security/cve-2026-47838. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all systems running Spring Security versions 5.7.0-5.7.24, 5.8.0-5.8.26, 6.3.0-6.3.17, 6.4.0-6.4.17, or 6.5.0-6.5.10 with X.509 certificate authentication enabled. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Local denial of service in Android's PackageInstaller subsystem stems from a logic error in PackageInstallerSession.tran
Cedar policy injection in CedarJava (com.cedarpolicy:cedar-java) versions below 2.3.6, 3.4.1, and 4.9.0 allows attackers
Type confusion in CedarJava versions prior to 2.3.6, 3.4.1, and 4.9 allows authenticated remote attackers to manipulate
Remote code execution in Spinnaker's Orca and Rosco services allows authenticated users to achieve arbitrary Java class
Denial of service in Steeltoe.Discovery.Eureka client (.NET) versions prior to 4.2.0 and 3.4.0 allows a remote Eureka re
Share
External POC / Exploit Code
Leaving vuln.today