CVE-2026-47838CWE-287

Unauthorized User Impersonation when Using X.509 Client Certificates

Medium · published June 9, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
8.6
In the wild
Unconfirmed
What it is

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.

Affected versions:

Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00194 · 8.6th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-06-09T23:50Z
EPSS history
Timeline
  • 09 JUN 23:50Z
    Unauthorized User Impersonation when Using X.509 Client Certificates
    cvelistv5