CVE-2026-40995: X.509 authentication bypasses Spring Security account checks
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40995?
CVE-2026-40995 has a medium severity rating of 5.4.
How do I fix CVE-2026-40995?
To fix CVE-2026-40995, update to a version of Spring Web Services that addresses this vulnerability.
What impact does CVE-2026-40995 have on my application?
CVE-2026-40995 allows for an authentication bypass, which can lead to unauthorized access to accounts.
What versions of Spring Web Services are affected by CVE-2026-40995?
CVE-2026-40995 affects specific versions of Spring Web Services that utilize the X509AuthenticationProvider.
Is user data at risk due to CVE-2026-40995?
Yes, CVE-2026-40995 can potentially expose user data if account checks are bypassed.