Executive brief
Spring Web Services is a framework component that handles certificate-based authentication for secure communication. The X509AuthenticationProvider fails to verify whether authenticated user accounts are active before granting access, allowing users with disabled, locked, or expired accounts to still authenticate if they possess a valid certificate. An attacker with a certificate mapped to a disabled or expired account could gain unauthorized access to protected resources.
Technical details
The vulnerability is an improper authentication flaw (CWE-287) in the X509AuthenticationProvider class, which processes X.509 certificate-based authentication. When a certificate successfully maps to UserDetails, the provider issues a fully authenticated X509AuthenticationToken without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, credentials-expired states). This affects both fresh user loads via X509AuthoritiesPopulator and cached entries from X509UserCache. The attack requires the attacker to possess a valid certificate that maps to a user account, but does not require additional privileges or user interaction. The fix enforces UserDetailsChecker strategy (defaulting to AccountStatusUserDetailsChecker) similar to AbstractUserDetailsAuthenticationProvider, allowing disabled/locked/expired accounts to be rejected. Patches are available in versions 5.0.2, 4.1.4, and later.
Affected products
- Pivotal Spring Web Services 5.0.0-5.0.1, 4.1.0-4.1.3, 4.0.0-4.0.18, 3.1.0-3.1.8
Timeline
- 2026-06-11: disclosed: Published to GitHub Advisory Database and NVD
- 2026-08-21: advisory: GitHub reviewed and updated advisory
- 2026-06-11: patched: Patches released: 5.0.2, 4.1.4 available; 4.0.x and 3.1.x appear unpatched