Executive brief
Spring Security, a widely used framework for securing Java applications, contains a vulnerability in how it processes digital certificates. An attacker can use a specially crafted certificate with a malformed Common Name (CN) to trick the system into identifying them as a different user. This could allow an unauthorized person to impersonate legitimate users and gain access to sensitive data or administrative functions.
Technical details
A vulnerability exists in Spring Security's SubjectX500PrincipalExtractor component due to improper validation of X.509 certificate Common Name (CN) values. When processing a certificate with a specifically malformed CN, the extractor may return an incorrect username, leading to authentication bypass via user impersonation. The attack requires the ability to present a crafted certificate to the application, typically in environments using X.509-based authentication. This issue affects versions 7.0.0 through 7.0.4 and is addressed in version 7.0.5. CVSS scores vary between 6.8 (Medium) and 8.1 (High) depending on the assumed attack complexity.
Affected products
- VMware Spring Security 7.0.0 through 7.0.4
Timeline
- 2026-04-22: disclosed: Initial vulnerability report and publication
- 2026-04-22: advisory: Vendor advisory published by VMware/Spring