CVE-2026-40995: X.509 authentication bypasses Spring Security account checks
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Ensure X509AuthenticationProvider applies Spring Security's standard account lifecycle checks (disabled, locked, expired, and credentials-expired) when a presented certificate is mapped to a UserDetails instance, before issuing a fully authenticated X509AuthenticationToken. Update configuration or application code so these checks are invoked for certificate-based authentication.
Spring Security (X509AuthenticationProvider) account_lifecycle_checks = enabled - Compensating control
If X.509 client-certificate authentication is not required, disable it until a patched/fixed version is available; otherwise restrict use of X.509 authentication to trusted networks and management interfaces (firewall/ACL) to reduce exposure.
- Operational
Audit recent authentications performed via X.509 certificates to identify tokens/sessions issued while account lifecycle checks may have been bypassed, and invalidate or re-authenticate those sessions and any accounts that require remediation (e.g., disabled or locked accounts).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40995?
CVE-2026-40995 has a medium severity rating of 5.4.
How do I fix CVE-2026-40995?
To fix CVE-2026-40995, update to a version of Spring Web Services that addresses this vulnerability.
What impact does CVE-2026-40995 have on my application?
CVE-2026-40995 allows for an authentication bypass, which can lead to unauthorized access to accounts.
What versions of Spring Web Services are affected by CVE-2026-40995?
CVE-2026-40995 affects specific versions of Spring Web Services that utilize the X509AuthenticationProvider.
Is user data at risk due to CVE-2026-40995?
Yes, CVE-2026-40995 can potentially expose user data if account checks are bypassed.