CVE-2026-22747

MEDIUM

Unauthorized User Impersonation when Using X.509 Client Certificates

Title source: cna
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2026-22747. PoCs published by F1n1Sh3r.

AI-analyzed exploit summary This repository contains a functional PoC for CVE-2026-22747, demonstrating unauthorized user impersonation via X.509 client certificate in Spring Security. It includes Java code to test vulnerable and patched versions, along with scripts to generate and validate certificates.

Description

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. This issue affects Spring Security: from 7.0.0 through 7.0.4.

Exploits (1)

github WORKING POC
by F1n1Sh3r · shellpoc
https://github.com/F1n1Sh3r/cve-2026-22747-lab

This repository contains a functional PoC for CVE-2026-22747, demonstrating unauthorized user impersonation via X.509 client certificate in Spring Security. It includes Java code to test vulnerable and patched versions, along with scripts to generate and validate certificates.

Classification
Working Poc 95%
Attack Type
Auth Bypass
Complexity
Moderate
Reliability
Reliable
Target: Spring Security 7.0.0-7.0.4
No auth needed
Prerequisites: JDK 17+ · Maven · OpenSSL · Bash
devstral-2 · analyzed Apr 28, 2026 Full analysis →

References (1)

Core 1

Scores

CVSS v3 6.8
EPSS 0.0015
EPSS Percentile 4.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-297
Status published
Products (3)
org.springframework.security/spring-security-web 7.0.0 - 7.0.5Maven
Spring/Spring Security 7.0.0 - 7.0.4
vmware/spring_security 7.0.0 - 7.0.5
Published Apr 22, 2026
Tracked Since Apr 22, 2026