Unauthorized User Impersonation when Using X.509 Client Certificates
Priority LOW 36CWE-287Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-287.
Summary
SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00133 2nd percentileScored 2026-11-07
Fix Fixed Spring Security (Spring): 5.7.25, 5.8.27, 6.3.18 +2org.springframework.security:spring-security-web (Maven): 6.5.11
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| VMware | Spring Security | 5.7.0 to before 5.7.25; 5.8.0 to before 5.8.27; 6.3.0 to before 6.3.18; 6.4.0 to before 6.4.18; 6.5.0 to before 6.5.10.2 | 5.7.25, 5.8.27, 6.3.18, 6.4.18, 6.5.10.2 | Patch available | CNA |
| — | org.springframework.security:spring-security-web (Maven) | 6.5.0 to before 6.5.11 | 6.5.11 | Patch available | GHSA-293q-567p-wmwq |
| — | org.springframework.security:spring-security-web (Maven) | 6.4.0 – 6.4.13 | — | No fix listed | GHSA-293q-567p-wmwq |
| — | org.springframework.security:spring-security-web (Maven) | 6.0.0 – 6.3.10 | — | No fix listed | GHSA-293q-567p-wmwq |
| — | org.springframework.security:spring-security-web (Maven) | 5.8.0 – 5.8.16 | — | No fix listed | GHSA-293q-567p-wmwq |
| — | org.springframework.security:spring-security-web (Maven) | up to 5.7.14 | — | No fix listed | GHSA-293q-567p-wmwq |
- Spring Security VendorVMware Affected 5.7.0 to before 5.7.25; 5.8.0 to before 5.8.27; 6.3.0 to before 6.3.18; 6.4.0 to before 6.4.18; 6.5.0 to before 6.5.10.2 Fixed in 5.7.25, 5.8.27, 6.3.18, 6.4.18, 6.5.10.2 Patch available CNA
- org.springframework.security:spring-security-web (Maven) Vendor— Affected 6.5.0 to before 6.5.11 Fixed in 6.5.11 Patch available GHSA-293q-567p-wmwq
- org.springframework.security:spring-security-web (Maven) Vendor— Affected 6.4.0 – 6.4.13 Fixed in — No fix listed GHSA-293q-567p-wmwq
- org.springframework.security:spring-security-web (Maven) Vendor— Affected 6.0.0 – 6.3.10 Fixed in — No fix listed GHSA-293q-567p-wmwq
- org.springframework.security:spring-security-web (Maven) Vendor— Affected 5.8.0 – 5.8.16 Fixed in — No fix listed GHSA-293q-567p-wmwq
- org.springframework.security:spring-security-web (Maven) Vendor— Affected up to 5.7.14 Fixed in — No fix listed GHSA-293q-567p-wmwq
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* | before 5.7.25; 5.8.0 to before 5.8.27; 6.3.0 to before 6.3.18; 6.4.0 to before 6.4.18; 6.5.0 to before 6.5.11 | Vulnerable | VMware |
- cpe:2.3:a:vmware:spring_security:*:*:*:*:*:*:*:* Versions before 5.7.25; 5.8.0 to before 5.8.27; 6.3.0 to before 6.3.18; 6.4.0 to before 6.4.18; 6.5.0 to before 6.5.11 Vulnerable ·VMware
Remediation
- Fix · CNA Spring Security (Spring) Fixed in 5.7.25, 5.8.27, 6.3.18, 6.4.18, 6.5.10.2
- Fix · GHSA-293q-567p-wmwq org.springframework.security:spring-security-web (Maven) Fixed in 6.5.11 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-47838
- 2026-10-03 Alias added: GHSA-293q-567p-wmwq
References
More VMware Spring Security vulnerabilities
- TI-2023-16900 Improper access control in Spring Security CVSS 3.1CRITICAL 9.8
- TI-2022-13611 Authorization bypass in Spring by VMware CVSS 3.1CRITICAL 9.8
- TI-2022-07154 Incorrect authorization in Spring Security CVSS 3.1CRITICAL 9.8
- TI-2026-42404 Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces CVSS 3.1CRITICAL 9.4
- TI-2026-18257 Under Some Conditions Spring Security HTTP Headers Are not Written CVSS 3.1CRITICAL 9.1
- TI-2014-02853 Improper authentication in Pivotal Spring Security CVSS 3.0CRITICAL 9.8
Sources
- CVE-2026-47838 · CVE Program
- CVE-2026-47838 · NVD
- FIRST EPSS
- GHSA-293q-567p-wmwq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences