CVE-2026-47838Medium· 6.8▾ SunlitSpring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.1%
0.1% → 0.2%
In Spring Security Web, SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
SubjectDnX509PrincipalExtractor is deprecated by this CVE and replaced with SubjectX500PrincipalExtractor. As part of updating, you should also migrate to SubjectX500PrincipalExtractor.
Affected versions: Spring Security Enterprise 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10. OSS 6.5.0 through 6.5.10.
org.springframework.security:spring-security-web >= 6.5.0, <= 6.5.10org.springframework.security:spring-security-web >= 6.4.0, <= 6.4.13org.springframework.security:spring-security-web >= 6.0.0, <= 6.3.10org.springframework.security:spring-security-web >= 5.8.0, <= 5.8.16org.springframework.security:spring-security-web <= 5.7.14Upgrade to a patched release:
org.springframework.security:spring-security-web 6.5.11Connected by shared product, vendor, weakness, or advisory.
CVE-2026-47892Critical· 9.8Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-47890Critical· 9.8Spring Framework Server Sent Event stream corruption while rendering fragments
CVE-2024-38819High· 7.5Spring Framework Path Traversal vulnerability
CVE-2023-49105Critical· 9.8An issue was discovered in ownCloud owncloud/core before 10.13.1
CVE-2019-1946Medium· 6.5A vulnerability in the web-based management interface of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to bypass authentication and get limited access to the web-based management int…
CVE-2022-40684Critical· 9.8An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 …