High severity · published Apr 22, 2026
CVE-2026-22747
Unauthorized User Impersonation when Using X.509 Client Certificates
8.1
CVSS
0.2%
EPSS
No
On KEV
Description
Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
This issue affects Spring Security: from 7.0.0 through 7.0.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Spring Security · Spring
7.0.0 through 7.0.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22747
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-22747
Vendor Advisory
https://spring.io/security/cve-2026-22747
access.redhat.com
https://access.redhat.com/security/cve/CVE-2026-22747
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2460487
security.access.redhat.com
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22747.json
More from Spring Security
9.1
CVE-2026-59270
Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
8.1
CVE-2026-47838
Unauthorized User Impersonation when Using X.509 Client Certificates
8.1
CVE-2026-22733
Authentication Bypass under Actuator CloudFoundry endpoints
7.5
CVE-2026-40988
Unbounded DEFLATE Inflation in SAML 2.0 Service Provider
7.5
CVE-2026-22754
ervlet Path Not Correctly Included in Path Matching of XML Authorization Rules