---
id: CVE-2026-47838
aliases:
  - GHSA-293q-567p-wmwq
title: >-
  Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509
  Client Certificates
summary: >-
  Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509
  Client Certificates
severity: medium
cvss: 6.8
cwe:
  - CWE-287
vendor: springframework
product: 'org.springframework.security:spring-security-web'
ecosystem: maven
affected:
  - 'org.springframework.security:spring-security-web >= 6.5.0, <= 6.5.10'
  - 'org.springframework.security:spring-security-web >= 6.4.0, <= 6.4.13'
  - 'org.springframework.security:spring-security-web >= 6.0.0, <= 6.3.10'
  - 'org.springframework.security:spring-security-web >= 5.8.0, <= 5.8.16'
  - 'org.springframework.security:spring-security-web <= 5.7.14'
patched:
  - 'org.springframework.security:spring-security-web 6.5.11'
published: '2026-06-10'
updated: '2026-06-30'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-293q-567p-wmwq'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-47838'
  - url: 'https://spring.io/security/cve-2026-47838'
  - url: 'https://github.com/advisories/GHSA-2jrg-rf5x-568g'
  - url: 'https://github.com/advisories/GHSA-293q-567p-wmwq'
tags:
  - ghsa
  - maven
epss: 0.00194
epssPercentile: 0.08098
ingestedAt: '2026-07-07T15:41:59.583Z'
---

## Overview

In Spring Security Web, `SubjectDnX509PrincipalExtractor` does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.

`SubjectDnX509PrincipalExtractor` is deprecated by this CVE and replaced with `SubjectX500PrincipalExtractor`. As part of updating, you should also migrate to `SubjectX500PrincipalExtractor`.

Affected versions:
Spring Security Enterprise 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10. 
OSS 6.5.0 through 6.5.10.

## Affected packages

- `org.springframework.security:spring-security-web >= 6.5.0, <= 6.5.10`
- `org.springframework.security:spring-security-web >= 6.4.0, <= 6.4.13`
- `org.springframework.security:spring-security-web >= 6.0.0, <= 6.3.10`
- `org.springframework.security:spring-security-web >= 5.8.0, <= 5.8.16`
- `org.springframework.security:spring-security-web <= 5.7.14`

## Remediation

Upgrade to a patched release:

- `org.springframework.security:spring-security-web 6.5.11`