Intel

CVE-2026-47838

org.springframework.security:spring-security-web: Improper Authentication (CVE-2026-47838)

highEPSS 0.2%

Affected

  • maven/org.springframework.security:spring-security-web 5.2.0.RELEASE..*
  • maven/org.springframework.security:spring-security-web 6.5.0..*
  • maven/org.springframework.security:spring-security-web 6.5.1..*
  • maven/org.springframework.security:spring-security-web 6.5.10..*
  • maven/org.springframework.security:spring-security-web 6.5.2..*
  • maven/org.springframework.security:spring-security-web 6.5.3..*
  • maven/org.springframework.security:spring-security-web 6.5.4..*
  • maven/org.springframework.security:spring-security-web 6.5.5..*
  • maven/org.springframework.security:spring-security-web 6.5.6..*
  • maven/org.springframework.security:spring-security-web 6.5.7..*
  • maven/org.springframework.security:spring-security-web 6.5.8..*
  • maven/org.springframework.security:spring-security-web 6.5.9..*
  • maven/org.springframework.security:spring-security-web 6.4.0..*
  • maven/org.springframework.security:spring-security-web 6.4.1..*
  • maven/org.springframework.security:spring-security-web 6.4.10..*
  • maven/org.springframework.security:spring-security-web 6.4.11..*
  • maven/org.springframework.security:spring-security-web 6.4.12..*
  • maven/org.springframework.security:spring-security-web 6.4.13..*
  • maven/org.springframework.security:spring-security-web 6.4.2..*
  • maven/org.springframework.security:spring-security-web 6.4.3..*
  • maven/org.springframework.security:spring-security-web 6.4.4..*
  • maven/org.springframework.security:spring-security-web 6.4.5..*
  • maven/org.springframework.security:spring-security-web 6.4.6..*
  • maven/org.springframework.security:spring-security-web 6.4.7..*
  • maven/org.springframework.security:spring-security-web 6.4.8..*
  • maven/org.springframework.security:spring-security-web 6.4.9..*
  • maven/org.springframework.security:spring-security-web 6.0.0..*
  • maven/org.springframework.security:spring-security-web 6.0.1..*
  • maven/org.springframework.security:spring-security-web 6.0.2..*
  • maven/org.springframework.security:spring-security-web 6.0.3..*
  • maven/org.springframework.security:spring-security-web 6.0.4..*
  • maven/org.springframework.security:spring-security-web 6.0.5..*
  • maven/org.springframework.security:spring-security-web 6.0.6..*
  • maven/org.springframework.security:spring-security-web 6.0.7..*
  • maven/org.springframework.security:spring-security-web 6.0.8..*
  • maven/org.springframework.security:spring-security-web 6.1.0..*
  • maven/org.springframework.security:spring-security-web 6.1.1..*
  • maven/org.springframework.security:spring-security-web 6.1.2..*
  • maven/org.springframework.security:spring-security-web 6.1.3..*
  • maven/org.springframework.security:spring-security-web 6.1.4..*
  • maven/org.springframework.security:spring-security-web 6.1.5..*
  • maven/org.springframework.security:spring-security-web 6.1.6..*
  • maven/org.springframework.security:spring-security-web 6.1.7..*
  • maven/org.springframework.security:spring-security-web 6.1.8..*
  • maven/org.springframework.security:spring-security-web 6.1.9..*
  • maven/org.springframework.security:spring-security-web 6.2.0..*
  • maven/org.springframework.security:spring-security-web 6.2.1..*
  • maven/org.springframework.security:spring-security-web 6.2.2..*
  • maven/org.springframework.security:spring-security-web 6.2.3..*
  • maven/org.springframework.security:spring-security-web 6.2.4..*
  • maven/org.springframework.security:spring-security-web 6.2.5..*
  • maven/org.springframework.security:spring-security-web 6.2.6..*
  • maven/org.springframework.security:spring-security-web 6.2.7..*
  • maven/org.springframework.security:spring-security-web 6.2.8..*
  • maven/org.springframework.security:spring-security-web 6.3.0..*
  • maven/org.springframework.security:spring-security-web 6.3.1..*
  • maven/org.springframework.security:spring-security-web 6.3.10..*
  • maven/org.springframework.security:spring-security-web 6.3.2..*
  • maven/org.springframework.security:spring-security-web 6.3.3..*
  • maven/org.springframework.security:spring-security-web 6.3.4..*
  • maven/org.springframework.security:spring-security-web 6.3.5..*
  • maven/org.springframework.security:spring-security-web 6.3.6..*
  • maven/org.springframework.security:spring-security-web 6.3.7..*
  • maven/org.springframework.security:spring-security-web 6.3.8..*
  • maven/org.springframework.security:spring-security-web 6.3.9..*
  • maven/org.springframework.security:spring-security-web 5.8.0..*
  • maven/org.springframework.security:spring-security-web 5.8.1..*
  • maven/org.springframework.security:spring-security-web 5.8.10..*
  • maven/org.springframework.security:spring-security-web 5.8.11..*
  • maven/org.springframework.security:spring-security-web 5.8.12..*
  • maven/org.springframework.security:spring-security-web 5.8.13..*
  • maven/org.springframework.security:spring-security-web 5.8.14..*
  • maven/org.springframework.security:spring-security-web 5.8.15..*
  • maven/org.springframework.security:spring-security-web 5.8.16..*
  • maven/org.springframework.security:spring-security-web 5.8.2..*
  • maven/org.springframework.security:spring-security-web 5.8.3..*
  • maven/org.springframework.security:spring-security-web 5.8.4..*
  • maven/org.springframework.security:spring-security-web 5.8.5..*
  • maven/org.springframework.security:spring-security-web 5.8.6..*
  • maven/org.springframework.security:spring-security-web 5.8.7..*
  • maven/org.springframework.security:spring-security-web 5.8.8..*
  • maven/org.springframework.security:spring-security-web 5.8.9..*
  • maven/org.springframework.security:spring-security-web 3.0.0.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.0.1.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.0.2.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.0.3.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.0.4.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.0.5.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.0.6.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.0.7.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.1.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.10.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.11.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.12.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.13.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.14.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.15.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.2.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.3.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.4.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.5.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.6.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.7.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.8.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.2.9.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.0.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.1.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.10.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.11.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.12.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.13.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.2.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.3.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.4.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.5.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.6.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.7.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.8.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.3.9.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.4.0..*
  • maven/org.springframework.security:spring-security-web 5.4.1..*
  • maven/org.springframework.security:spring-security-web 5.4.10..*
  • maven/org.springframework.security:spring-security-web 3.0.8.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.1.0.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.1.1.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.1.2.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.1.3.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.1.4.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.1.5.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.1.6.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.1.7.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.2.0.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.2.1.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.2.10.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.2.2.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.2.3.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.2.4.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.2.5.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.2.6.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.2.7.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.2.8.RELEASE..*
  • maven/org.springframework.security:spring-security-web 3.2.9.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.0.0.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.0.1.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.0.2.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.0.3.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.0.4.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.1.0.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.1.1.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.1.2.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.1.3.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.1.4.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.1.5.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.0.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.1.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.10.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.11.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.12.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.13.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.14.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.15.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.16.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.17.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.18.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.19.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.2.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.20.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.3.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.4.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.5.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.6.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.7.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.8.RELEASE..*
  • maven/org.springframework.security:spring-security-web 4.2.9.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.0.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.1.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.10.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.11.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.12.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.13.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.14.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.15.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.16.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.17.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.18.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.19.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.2.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.3.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.4.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.5.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.6.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.7.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.8.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.0.9.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.1.0.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.1.1.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.1.10.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.1.11.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.1.12.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.1.13.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.1.2.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.1.3.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.1.4.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.1.5.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.1.6.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.1.7.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.1.8.RELEASE..*
  • maven/org.springframework.security:spring-security-web 5.4.11..*
  • maven/org.springframework.security:spring-security-web 5.4.2..*
  • maven/org.springframework.security:spring-security-web 5.4.3..*
  • maven/org.springframework.security:spring-security-web 5.4.4..*
  • maven/org.springframework.security:spring-security-web 5.4.5..*
  • maven/org.springframework.security:spring-security-web 5.4.6..*
  • maven/org.springframework.security:spring-security-web 5.4.7..*
  • maven/org.springframework.security:spring-security-web 5.4.8..*
  • maven/org.springframework.security:spring-security-web 5.4.9..*
  • maven/org.springframework.security:spring-security-web 5.5.0..*
  • maven/org.springframework.security:spring-security-web 5.5.1..*
  • maven/org.springframework.security:spring-security-web 5.5.2..*
  • maven/org.springframework.security:spring-security-web 5.5.3..*
  • maven/org.springframework.security:spring-security-web 5.5.4..*
  • maven/org.springframework.security:spring-security-web 5.5.5..*
  • maven/org.springframework.security:spring-security-web 5.5.6..*
  • maven/org.springframework.security:spring-security-web 5.5.7..*
  • maven/org.springframework.security:spring-security-web 5.5.8..*
  • maven/org.springframework.security:spring-security-web 5.6.0..*
  • maven/org.springframework.security:spring-security-web 5.6.1..*
  • maven/org.springframework.security:spring-security-web 5.6.10..*
  • maven/org.springframework.security:spring-security-web 5.6.11..*
  • maven/org.springframework.security:spring-security-web 5.6.12..*
  • maven/org.springframework.security:spring-security-web 5.6.2..*
  • maven/org.springframework.security:spring-security-web 5.6.3..*
  • maven/org.springframework.security:spring-security-web 5.6.4..*
  • maven/org.springframework.security:spring-security-web 5.6.5..*
  • maven/org.springframework.security:spring-security-web 5.6.6..*
  • maven/org.springframework.security:spring-security-web 5.6.7..*
  • maven/org.springframework.security:spring-security-web 5.6.8..*
  • maven/org.springframework.security:spring-security-web 5.6.9..*
  • maven/org.springframework.security:spring-security-web 5.7.0..*
  • maven/org.springframework.security:spring-security-web 5.7.1..*
  • maven/org.springframework.security:spring-security-web 5.7.10..*
  • maven/org.springframework.security:spring-security-web 5.7.11..*
  • maven/org.springframework.security:spring-security-web 5.7.12..*
  • maven/org.springframework.security:spring-security-web 5.7.13..*
  • maven/org.springframework.security:spring-security-web 5.7.14..*
  • maven/org.springframework.security:spring-security-web 5.7.2..*
  • maven/org.springframework.security:spring-security-web 5.7.3..*
  • maven/org.springframework.security:spring-security-web 5.7.4..*
  • maven/org.springframework.security:spring-security-web 5.7.5..*
  • maven/org.springframework.security:spring-security-web 5.7.6..*
  • maven/org.springframework.security:spring-security-web 5.7.7..*
  • maven/org.springframework.security:spring-security-web 5.7.8..*
  • maven/org.springframework.security:spring-security-web 5.7.9..*
  • maven/org.springframework.security:spring-security-web 5.1.9.RELEASE..*

Description

SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected versions: Spring Security 5.7.0 through 5.7.24; 5.8.0 through 5.8.26; 6.3.0 through 6.3.17; 6.4.0 through 6.4.17; 6.5.0 through 6.5.10.

Source: BSI WID PortalBSI CSAFOSV (Open Source Vulnerabilities)cvelistv5NVD (NIST)CVE.org (MITRE)

Affected products

The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

mavenorg.springframework.security:spring-security-web
3.0.0.RELEASE3.0.1.RELEASE3.0.2.RELEASE3.0.3.RELEASE3.0.4.RELEASE3.0.5.RELEASE3.0.6.RELEASE3.0.7.RELEASE3.0.8.RELEASE3.1.0.RELEASE3.1.1.RELEASE3.1.2.RELEASE3.1.3.RELEASE3.1.4.RELEASE3.1.5.RELEASE3.1.6.RELEASE3.1.7.RELEASE3.2.0.RELEASE3.2.10.RELEASE3.2.1.RELEASE3.2.2.RELEASE3.2.3.RELEASE3.2.4.RELEASE3.2.5.RELEASE3.2.6.RELEASE3.2.7.RELEASE3.2.8.RELEASE3.2.9.RELEASE4.0.0.RELEASE4.0.1.RELEASE4.0.2.RELEASE4.0.3.RELEASE4.0.4.RELEASE4.1.0.RELEASE4.1.1.RELEASE4.1.2.RELEASE4.1.3.RELEASE4.1.4.RELEASE4.1.5.RELEASE4.2.0.RELEASE4.2.10.RELEASE4.2.11.RELEASE4.2.12.RELEASE4.2.13.RELEASE4.2.14.RELEASE4.2.15.RELEASE4.2.16.RELEASE4.2.17.RELEASE

Metrics

XIEM Effective CVSS
8.1
Source: nvd-v3
EPSS percentile
8.3 %
Low — this CVE sits in the lower 10% of all CVEs scored today.
KEV status
—
Show all metrics
Severity
high
Priority score
54.30
Exploit maturity
no public PoC known
CVSS v3
6.8
EPSS score
0.2 %
Low — model estimates < 1% exploitation likelihood.
Published
2026-06-10 00:31 UTC
CWE
CWE-287

Weakness classes (CWE)

  • CWE-287Class

    Improper Authentication

    When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

    cwe.mitre.org →

References & sources

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Translated2026-07-23 09:10 UTC· nvd@nist.gov
    • Translation: Title: Spring Security de Spring, Description: SubjectDnX509PrincipalExtractor no maneja correctamente ciertos valores CN malformados de certificados X.509, lo que puede llevar a la lectura de un valor incorrecto para el nombre de usuario. En un certificado cuidadosamente elaborado, esto puede llevar a un atacante suplantando a otro usuario. Versiones afectadas: Spring Security 5.7.0 a 5.7.24; 5.8.0 a 5.8.26; 6.3.0 a 6.3.17; 6.4.0 a 6.4.17; 6.5.0 a 6.5.10.