CVE-2026-40995: X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying…

PriorityP431medium5.4CVSS 3.1

AVNACLPRLUINSUCLILAN

EPSS

0.15%

4.5th percentile

X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts). Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
spring	spring_web_services	>= 3.1.0 < 3.1.9	3.1.9
spring	spring_web_services	>= 4.0.0 < 4.0.19	4.0.19
spring	spring_web_services	>= 4.1.0 < 4.1.3.1	4.1.3.1
spring	spring_web_services	>= 5.0.0 < 5.0.1.1	5.0.1.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.