# CVE-2026-40995: VMware Spring Web Services improper authentication in X509AuthenticationProvider

Source: https://junglewise.ai/threats/cve-2026-40995-vmware-spring-web-services-improper-authentication-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-40995 · Severity: medium · CVSS 5.4 · Published 2026-06-11

Spring Web Services is a framework component that handles certificate-based authentication for secure communication. The X509AuthenticationProvider fails to verify whether authenticated user accounts are active before granting access, allowing users with disabled, locked, or expired accounts to still authenticate if they possess a valid certificate. An attacker with a certificate mapped to a disabled or expired account could gain unauthorized access to protected resources.

Technologies: [org.springframework.ws:spring-ws-security (Maven)](https://junglewise.ai/threats/technologies/org-springframework-ws-spring-ws-security), [VMware Spring Web Services](https://junglewise.ai/threats/technologies/web-services). Vendors: [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-40995 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40995 being exploited in the wild.

**How severe is CVE-2026-40995?** Medium severity, with a CVSS score of 5.4, published 11 June 2026.

**Which products and versions are affected?** org.springframework.ws:spring-ws-security (Maven) ECOSYSTEM:introduced=5.0.0,fixed=5.0.2; VMware Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

**Is there a fix for CVE-2026-40995?** Yes. org.springframework.ws:spring-ws-security (Maven): upgrade to 5.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40995 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-40995?** Check whether you run org.springframework.ws:spring-ws-security (Maven) or VMware Spring Web Services at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.ws:spring-ws-security (Maven): upgrade to 5.0.2 or later

  ```sh
  # set org.springframework.ws:spring-ws-security to 5.0.2 in your pom.xml or build.gradle
  ```


## Technical details

The vulnerability is an improper authentication flaw (CWE-287) in the X509AuthenticationProvider class, which processes X.509 certificate-based authentication. When a certificate successfully maps to UserDetails, the provider issues a fully authenticated X509AuthenticationToken without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, credentials-expired states). This affects both fresh user loads via X509AuthoritiesPopulator and cached entries from X509UserCache. The attack requires the attacker to possess a valid certificate that maps to a user account, but does not require additional privileges or user interaction. The fix enforces UserDetailsChecker strategy (defaulting to AccountStatusUserDetailsChecker) similar to AbstractUserDetailsAuthenticationProvider, allowing disabled/locked/expired accounts to be rejected. Patches are available in versions 5.0.2, 4.1.4, and later.

## Affected products

- Pivotal Spring Web Services 5.0.0-5.0.1, 4.1.0-4.1.3, 4.0.0-4.0.18, 3.1.0-3.1.8

## Identifiers

- CVE-2026-40995
- GHSA-6mfm-98wv-32wm

## Timeline

- 2026-06-11: disclosed: Published to GitHub Advisory Database and NVD
- 2026-08-21: advisory: GitHub reviewed and updated advisory
- 2026-06-11: patched: Patches released: 5.0.2, 4.1.4 available; 4.0.x and 3.1.x appear unpatched

## References

- [https://spring.io/security/cve-2026-40995](https://spring.io/security/cve-2026-40995)
- [https://github.com/spring-projects/spring-ws/commit/e5dc311359e14f5b25bcb33f20d43cc3513e9d10](https://github.com/spring-projects/spring-ws/commit/e5dc311359e14f5b25bcb33f20d43cc3513e9d10)

## Related threats

- [VMware Spring Web Services replay attack bypass in Wss4jSecurityInterceptor](https://junglewise.ai/threats/cve-2026-41000-vmware-spring-web-services-replay-attack-bypass-in)
- [VMware Spring Web Services SSRF via WS-Addressing headers](https://junglewise.ai/threats/cve-2026-40999-vmware-spring-web-services-ssrf-via-ws-addressing-headers)
- [VMware Spring Web Services XXE in Jaxp13XPathTemplate](https://junglewise.ai/threats/cve-2026-40998-vmware-spring-web-services-xxe-in-jaxp13xpathtemplate)
- [VMware Spring Web Services information disclosure in Spring Security integration](https://junglewise.ai/threats/cve-2026-40997-vmware-spring-web-services-information-disclosure-in-spring)
- [VMware Spring Web Services insecure default in Wss4jSecurityInterceptor](https://junglewise.ai/threats/cve-2026-40996-vmware-spring-web-services-insecure-default-in)