CVE-2026-47838

Overview

Spring Security is the de facto authentication and authorization framework for Spring applications, and it includes support for X.509 client-certificate pre-authentication, where the username of the requesting principal is derived from the subject of the presented certificate.

A medium-severity vulnerability (CVE-2026-47838) has been identified in Spring Security's X.509 support. The legacy SubjectDnX509PrincipalExtractor derives the username by running a regular expression over the string form of the certificate subject returned by X509Certificate.getSubjectDN().getName(). That string form is non-canonical and implementation-dependent, and the default regular expression does not correctly handle certain malformed CN values. With a carefully crafted certificate, the extractor can read a CN value belonging to a different identity, allowing an attacker to be authenticated as another user. This is a continuation of CVE-2026-22747, which addressed the same class of issue for the SubjectX500PrincipalExtractor in Spring Security 7.0.x.

Per OWASP, broken access control occurs when restrictions on what authenticated users are allowed to do are not properly enforced, so that an actor is able to act outside of their intended permissions, for example by assuming another user's identity. Here the identity itself is confused at authentication time: a crafted certificate causes the principal to be resolved to a victim's username, so the attacker inherits that victim's authorities.

This component sits behind Spring Security's pre-authentication flow, which assumes the presented credentials have already been validated by a trusted upstream. Exploiting this issue therefore presupposes a compromise of that upstream trust, so the fix is best understood as defense-in-depth rather than as closing a standalone attack path.

This issue affects >=4.2.0 <=4.2.20, >=5.5.0 <=5.5.8, >=5.7.0 <=5.7.24, >=5.8.0 <=5.8.26, >=6.0.0 <=6.0.8, >=6.1.0 <=6.1.9, >=6.2.0 <=6.2.8, >=6.3.0 <=6.3.17, >=6.4.0 <=6.4.17 and >=6.5.0 <=6.5.10 of Spring Security.

Details

Module Info

• Product: Spring Security
• Affected packages: spring-security-web
• Affected versions: >=4.2.0 <=4.2.20, >=5.5.0 <=5.5.8, >=5.7.0 <=5.7.24, >=5.8.0 <=5.8.26, >=6.0.0 <=6.0.8, >=6.1.0 <=6.1.9, >=6.2.0 <=6.2.8, >=6.3.0 <=6.3.17, >=6.4.0 <=6.4.17, >=6.5.0 <=6.5.10
• GitHub repository: https://github.com/spring-projects/spring-security
• Published packages: https://central.sonatype.com/artifact/org.springframework.security/spring-security-web
• Package manager: Maven
• Fixed in:
  • NES for Spring Security 4.2.x, 5.5.x, 5.7.x, 5.8.x, 6.2.x, 6.3.x, 6.4.x
  • Spring Security 6.5.11 (OSS)

Vulnerability Info

When an application uses X.509 client-certificate pre-authentication, Spring Security extracts the principal name from the certificate subject. The legacy SubjectDnX509PrincipalExtractor does this by matching a regular expression against the legacy string rendering of the subject distinguished name. Its default constructor configures the pattern CN=(.*?)(?:,|$), and the principal is taken from the first capture group:

public SubjectDnX509PrincipalExtractor() {
    setSubjectDnRegex("CN=(.*?)(?:,|$)");
}

@Override
public Object extractPrincipal(X509Certificate clientCert) {
    String subjectDN = clientCert.getSubjectDN().getName();
    Matcher matcher = this.subjectDnPattern.matcher(subjectDN);
    if (!matcher.find()) {
        throw new BadCredentialsException(...);
    }
    return matcher.group(1);
}

X509Certificate.getSubjectDN().getName() returns a non-canonical, implementation-dependent string rendering of the distinguished name, and a single naive regular expression cannot reliably interpret escaped characters, embedded delimiters, or multi-valued relative distinguished names. A certificate whose subject embeds an attacker-controlled CN token, or that exploits comma and escape handling in the rendered string, can cause the extractor to capture a CN value that does not correspond to the certificate's true subject. The resolved username is then used as the authenticated principal, so the attacker is treated as whichever user the misread CN names.

The remediation is structural rather than a change to the regular expression. Spring Security provides SubjectX500PrincipalExtractor as the secure replacement, which parses the canonical X500Principal.getName(RFC2253) form with javax.naming.ldap.LdapName and selects the most specific relative distinguished name, and it deprecates SubjectDnX509PrincipalExtractor. Applications using X.509 pre-authentication should migrate to SubjectX500PrincipalExtractor.

This vulnerability has been present since the introduction of Spring Security's X.509 support and predates the version floor stated in the advisory.

Mitigation

Spring Security End-of-Life versions in open source have no publicly available fix for this issue; see https://spring.io/projects/spring-security for the support timeline. HeroDevs does not recommend that users attempt to develop and apply their own source patches to End-of-Life software.

The recommended actions are:

1. Upgrade to a supported, fixed release. The issue is fixed in OSS in Spring Security 6.5.11, and applications should migrate X.509 pre-authentication from SubjectDnX509PrincipalExtractor to SubjectX500PrincipalExtractor.
2. For End-of-Life lines that cannot be upgraded, HeroDevs Never-Ending Support (NES) for Spring Security provides a drop-in replacement that backports this fix while remaining compatible with the affected versions. Learn more about HeroDevs Never-Ending Support for Spring Security.

Credits

• Nikita Markevich (finder)