Loading vulnerability…
Spring Web Services X.509 Account-Status Authentication Bypass
CVE-2026-40995 is an improper-authentication vulnerability in Spring Web Services spring-ws-security. X509AuthenticationProvider can create a fully authenticated X509AuthenticationToken for a presented X.509 certificate that maps to a UserDetails record without applying Spring Security account lifecycle validation. Consequently, the provider does not reject accounts marked disabled, locked, expired, or credentials-expired. Affected versions are Spring Web Services 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An otherwise valid certificate associated with an inactive account can authenticate successfully and be treated as fully authenticated. This bypasses account disablement, lockout, account-expiration, and credential-expiration controls in certificate-based Spring Web Services authentication, potentially allowing unauthorized access and actions permitted to the mapped account.
If you can’t patch tonight, do this now.
No separate product-level mitigation is specified beyond applying the fixed release. Until patched, restrict certificate-based authentication to trusted clients, revoke or otherwise invalidate certificates associated with disabled or non-active accounts, and limit the authorization assigned to certificate-mapped identities.
Patch, then assume compromise.
Upgrade Spring Web Services spring-ws-security to 5.0.2 or later for the 5.0.x line, or 4.1.4 or later for the 4.1.x line. Enterprise Support fixes are 5.0.1.1, 4.1.3.1, 4.0.19, and 3.1.9 for their respective maintained enterprise branches. Deployments on unsupported 3.1.x or 4.0.x releases without access to an enterprise fix should migrate to a supported fixed branch.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.