{"id":"CVE-2026-47838","aliases":["GHSA-293q-567p-wmwq"],"title":"Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates","summary":"Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates","severity":"medium","cvss":6.8,"cwe":["CWE-287"],"vendor":"springframework","product":"org.springframework.security:spring-security-web","ecosystem":"maven","affected":["org.springframework.security:spring-security-web >= 6.5.0, <= 6.5.10","org.springframework.security:spring-security-web >= 6.4.0, <= 6.4.13","org.springframework.security:spring-security-web >= 6.0.0, <= 6.3.10","org.springframework.security:spring-security-web >= 5.8.0, <= 5.8.16","org.springframework.security:spring-security-web <= 5.7.14"],"patched":["org.springframework.security:spring-security-web 6.5.11"],"published":"2026-06-10","updated":"2026-06-30","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-293q-567p-wmwq","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47838"},{"url":"https://spring.io/security/cve-2026-47838"},{"url":"https://github.com/advisories/GHSA-2jrg-rf5x-568g"},{"url":"https://github.com/advisories/GHSA-293q-567p-wmwq"}],"tags":["ghsa","maven"],"epss":0.00133,"epssPercentile":0.03182,"ingestedAt":"2026-07-07T15:41:59.583Z","slug":"CVE-2026-47838","body":"## Overview\n\nIn Spring Security Web, `SubjectDnX509PrincipalExtractor` does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.\n\n`SubjectDnX509PrincipalExtractor` is deprecated by this CVE and replaced with `SubjectX500PrincipalExtractor`. As part of updating, you should also migrate to `SubjectX500PrincipalExtractor`.\n\nAffected versions:\nSpring Security Enterprise 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10. \nOSS 6.5.0 through 6.5.10.\n\n## Affected packages\n\n- `org.springframework.security:spring-security-web >= 6.5.0, <= 6.5.10`\n- `org.springframework.security:spring-security-web >= 6.4.0, <= 6.4.13`\n- `org.springframework.security:spring-security-web >= 6.0.0, <= 6.3.10`\n- `org.springframework.security:spring-security-web >= 5.8.0, <= 5.8.16`\n- `org.springframework.security:spring-security-web <= 5.7.14`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.springframework.security:spring-security-web 6.5.11`","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":37.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}