Executive brief
Spring Security is a framework used to secure Java-based web applications. A vulnerability in how it processes digital certificates (X.509) allows an attacker to provide a specially crafted certificate to impersonate another user. This could lead to unauthorized access to sensitive data or administrative functions by bypassing intended identity verification.
Technical details
A vulnerability exists in Spring Security Web's SubjectDnX509PrincipalExtractor where malformed X.509 certificate Common Name (CN) values are incorrectly parsed. This improper authentication flaw (CWE-287) allows an attacker with the ability to present a crafted certificate to have their username misidentified as a different user, leading to impersonation. The attack requires network access and has high complexity as it involves crafting specific certificate values. The SubjectDnX509PrincipalExtractor component has been deprecated and replaced by SubjectX500PrincipalExtractor to resolve this issue. Users should update to patched versions (e.g., 6.5.11) and migrate to the new extractor.
Affected products
- Spring Spring Security Web 5.7.0 through 5.7.24, 5.8.0 through 5.8.26, 6.3.0 through 6.3.17, 6.4.0 through 6.4.17, 6.5.0 through 6.5.10
Timeline
- 2026-06-10: disclosed
- 2026-06-10: advisory