CVE-2026-40995

Vulnerability

In Spring Web Services, the X509AuthenticationProvider bypasses Spring Security's standard account lifecycle checks (disabled, locked, expired, credentials-expired) when a presented X.509 certificate maps to a UserDetails object. This behavior applies to users resolved from an X509AuthoritiesPopulator and to cached entries. Affected versions: Spring Web Services 5.0.0 through 5.0.1, 4.1.0 through 4.1.3, 4.0.0 through 4.0.18, and 3.1.0 through 3.1.8. The vulnerability is reachable when certificate-based authentication is wired through Spring WS X.509 integration with Spring Security and user records that should not authenticate (e.g., disabled, locked, expired) are present.

Exploitation

An attacker needs a valid X.509 client certificate that maps to a UserDetails object in the target application. No additional authentication is required. During mutual TLS or certificate-based SOAP authentication, the attacker presents the certificate. The X509AuthenticationProvider issues a fully authenticated X509AuthenticationToken without performing the standard account status checks, even if the mapped user account is disabled, locked, expired, or has expired credentials.

Impact

Successful exploitation allows an attacker with a certificate mapped to an otherwise restricted user account to authenticate and gain access to the application. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) indicates low confidentiality and integrity impact; the attacker can read and modify data available to that account, despite the account’s disabled or locked state. The attacker assumes the privilege level of the mapped user.

Mitigation

Fixed versions are available: 5.0.2 (Open Source), 5.0.1.1 (Enterprise Support), 4.1.4 (Open Source), 4.1.3.1 (Enterprise Support), 4.0.19 (Enterprise Support), and 3.1.9 (Enterprise Support) [1]. Users of affected versions should upgrade to the corresponding fixed version. No further mitigation steps are necessary according to the advisory. Unsupported versions remain vulnerable.