CVE-2026-22747

Unauthorized User Impersonation when Using X.509 Client Certificates

Medium · published April 22, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
21.1
In the wild
Unconfirmed
What it is

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.

This issue affects Spring Security: from 7.0.0 through 7.0.4.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.1th percentile
Published
2026-04-22T05:08Z
EPSS history
Timeline
  • 22 APR 05:08Z
    Unauthorized User Impersonation when Using X.509 Client Certificates
    cvelistv5