# CVE-2026-47838: VMware Spring Security user impersonation in SubjectDnX509PrincipalExtractor

Source: https://junglewise.ai/threats/cve-2026-47838-vmware-spring-security-user-impersonation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-10. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-47838 · Severity: medium · CVSS 6.8 · Published 2026-06-10

Spring Security is a framework used to secure Java-based web applications. A vulnerability in how it processes digital certificates (X.509) allows an attacker to provide a specially crafted certificate to impersonate another user. This could lead to unauthorized access to sensitive data or administrative functions by bypassing intended identity verification.

Technologies: [org.springframework.security:spring-security-web (Maven)](https://junglewise.ai/threats/technologies/org-springframework-security-spring-security-web), [VMware Spring Security](https://junglewise.ai/threats/technologies/spring-security). Vendors: [Broadcom](https://junglewise.ai/threats/vendors/broadcom), [Maven](https://junglewise.ai/threats/vendors/maven), [VMware](https://junglewise.ai/threats/vendors/vmware).

## Quick answers

**Is CVE-2026-47838 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47838 being exploited in the wild.

**How severe is CVE-2026-47838?** Medium severity, with a CVSS score of 6.8, published 10 June 2026.

**Which products and versions are affected?** Broadcom Spring Security Web 5.7.0 through 5.7.24, 5.8.0 through 5.8.26, 6.3.0 through 6.3.17, 6.4.0 through 6.4.17, 6.5.0 through 6.5.10; org.springframework.security:spring-security-web (Maven) ECOSYSTEM:introduced=6.5.0,fixed=6.5.11; VMware Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.

**Is there a fix for CVE-2026-47838?** Yes. org.springframework.security:spring-security-web (Maven): upgrade to 6.5.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47838 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47838?** Check whether you run Broadcom Spring Security Web, org.springframework.security:spring-security-web (Maven) or VMware Spring Security at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.springframework.security:spring-security-web (Maven): upgrade to 6.5.11 or later

  ```sh
  # set org.springframework.security:spring-security-web to 6.5.11 in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability exists in Spring Security Web's SubjectDnX509PrincipalExtractor where malformed X.509 certificate Common Name (CN) values are incorrectly parsed. This improper authentication flaw (CWE-287) allows an attacker with the ability to present a crafted certificate to have their username misidentified as a different user, leading to impersonation. The attack requires network access and has high complexity as it involves crafting specific certificate values. The SubjectDnX509PrincipalExtractor component has been deprecated and replaced by SubjectX500PrincipalExtractor to resolve this issue. Users should update to patched versions (e.g., 6.5.11) and migrate to the new extractor.

## Affected products

- Spring Spring Security Web 5.7.0 through 5.7.24, 5.8.0 through 5.8.26, 6.3.0 through 6.3.17, 6.4.0 through 6.4.17, 6.5.0 through 6.5.10

## Identifiers

- CVE-2026-47838
- GHSA-293q-567p-wmwq

## Timeline

- 2026-06-10: disclosed
- 2026-06-10: advisory

## References

- [https://api.github.com/users/marcelstoer](https://api.github.com/users/marcelstoer)
- [https://github.com/marcelstoer](https://github.com/marcelstoer)
- [https://api.github.com/users/marcelstoer/gists%7B/gist_id%7D](https://api.github.com/users/marcelstoer/gists%7B/gist_id%7D)
- [https://api.github.com/users/marcelstoer/repos](https://api.github.com/users/marcelstoer/repos)
- [https://avatars.githubusercontent.com/u/624195?v=4](https://avatars.githubusercontent.com/u/624195?v=4)
- [https://api.github.com/users/marcelstoer/events%7B/privacy%7D](https://api.github.com/users/marcelstoer/events%7B/privacy%7D)

## Related threats

- [Spring Security InetAddressMatchers IP classification bypass](https://junglewise.ai/threats/cve-2026-59277-spring-security-inetaddressmatchers-ip-classification-bypass)
- [Spring Security timing attack on security-sensitive string comparison](https://junglewise.ai/threats/cve-2026-59276-spring-security-timing-attack-on-security-sensitive-string)
- [Spring Security OAuth2 Authorization Server metadata validation in Dynamic Client Registration](https://junglewise.ai/threats/cve-2026-59354-spring-security-oauth2-authorization-server-metadata-validation)
- [Spring Security embedded UnboundID LDAP server authentication bypass](https://junglewise.ai/threats/cve-2026-59270-spring-security-embedded-unboundid-ldap-server-authentication)
- [Spring Security WebAuthn user verification bypass in distributed sessions](https://junglewise.ai/threats/cve-2026-47841-spring-security-webauthn-user-verification-bypass-in-distributed)