CVE-2026-40995— X.509 authentication bypasses Spring Security account checks
Possible ATT&CK Techniques 1AI
T1199 · Trusted RelationshipAffected Version Matrix 4
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Spring | Spring Web Services | 5.0.0< 5.0.2 | affected |
4.1.0< 4.1.4 | affected | ||
4.0.0< 4.0.19 | affected | ||
3.1.0< 3.1.9 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-40995
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
X.509 authentication bypasses Spring Security account checks
Source: NVD (National Vulnerability Database)
Vulnerability Description
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts). Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
认证机制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
VMware Spring Web Services 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
VMware Spring Web Services是美国威睿（VMware）公司的一个SOAP Web服务开发框架。 VMware Spring Web Services 5.0.0至5.0.1版本、4.1.0至4.1.3版本、4.0.0至4.0.18版本和3.1.0至3.1.8版本存在授权问题漏洞，该漏洞源于X509AuthenticationProvider在证书映射到UserDetails时未应用账户生命周期检查，可能导致完全认证。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Spring | Spring Web Services | 5.0.0 ~ 5.0.1.1 | - |
II. Public POCs for CVE-2026-40995
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-40995
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-40995 (1)
Same Patch Batch · Spring · 2026-06-11 · 15 CVEs total
| CVE-2026-40999 | 8.6 HIGH | Spring WS SSRF via unvalidated WS-Addressing reply destinations |
| CVE-2026-40998 | 8.2 HIGH | Jaxp13 XPath XXE via StreamSource and SAXSource |
| CVE-2026-40994 | 8.2 HIGH | Wss4jSecurityInterceptor disables WS-I BSP validation by default |
| CVE-2026-41699 | 8.1 HIGH | Unsafe Deserialization in Spring GraphQL |
| CVE-2026-41700 | 8.1 HIGH | Cross-Site WebSocket Hijacking in Spring for GraphQL |
| CVE-2026-41856 | 7.5 HIGH | Spring GraphQL Annotation Detection Vulnerability |
| CVE-2026-40987 | 7.1 HIGH | Remote-file synchronizer in Spring Integration writes server-supplied filename under local |
| CVE-2026-40985 | 6.4 MEDIUM | Data Binding Vulnerability in Spring Web Flow with Unified EL Parser |
| CVE-2026-41001 | 5.3 MEDIUM | Predictable Temp Directory in Artemis Auto-configuration |
| CVE-2026-40997 | 5.3 MEDIUM | SOAP security faults leak Spring Security account state |
| CVE-2026-40992 | 5.0 MEDIUM | Mail Auto-Configuration Does Not Enable SSL Hostname Verification |
| CVE-2026-40996 | 4.8 MEDIUM | Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by default |
| CVE-2026-40986 | 4.8 MEDIUM | Spring Web Flow JS RemotingHandler renders non-HTML Response as HTML |
| CVE-2026-41000 | 3.7 LOW | WSS4J validation does not use configured replay cache |
IV. Related Vulnerabilities
Same product: Spring Web Services
- CVE-2026-41000
WSS4J validation does not use configured replay cache - CVE-2026-40999
Spring WS SSRF via unvalidated WS-Addressing reply destinati - CVE-2026-40998
Jaxp13 XPath XXE via StreamSource and SAXSource - CVE-2026-40997
SOAP security faults leak Spring Security account state - CVE-2026-40996
Inbound WS-Security allows RSA PKCS#1 v1.5 key transport by
Same vendor: Spring
- CVE-2026-41862
Spring Statemachine RCE漏洞，影响3.2.x及4.0.x版本 - CVE-2026-47825
Spring Cloud Gateway Server Forwards Headers from Untrusted - CVE-2026-41708
Spring Cloud Sleuth instrumentation of Spring TX DoS vulnera - CVE-2026-47835
Spring AI vector store metadata filtering to handle special - CVE-2026-41856
Spring GraphQL Annotation Detection Vulnerability
Same weakness: CWE-287
- CVE-2026-58399
@acastellon/auth has an authentication bypass via spoofable - CVE-2026-11387
SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation vi - CVE-2026-56219
Capgo - Unauthenticated RBAC Bindings and Email Disclosure v - CVE-2026-10560
Unauthenticated Access to Private Flow Build Events and Canc - CVE-2026-55955
Apache Tomcat: EncryptInterceptor not protected against repl
V. Comments for CVE-2026-40995
No comments yet