CVE-2026-22747

MEDIUM

Unauthorized User Impersonation when Using X.509 Client Certificates

Title source: cna
STIX 2.1

Description

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.

Exploits (1)

github WORKING POC
by F1n1Sh3r · shellpoc
https://github.com/F1n1Sh3r/cve-2026-22747-lab

References (1)

Core 1

Scores

CVSS v3 6.8
EPSS 0.0003
EPSS Percentile 7.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-297
Status published
Products (1)
Spring/Spring Security 7.0.0 - 7.0.4
Published Apr 22, 2026
Tracked Since Apr 22, 2026