CVE-2026-22747

CVSS Score & Metrics

Base Score

6.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N                                    

Vulnerability Description

Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user.
This issue affects Spring Security: from 7.0.0 through 7.0.4.

Vulnerability Details

Published Date

April 22, 2026

Last Modified

April 24, 2026

CWE ID

CWE-297

Source

NVD

Vendor

Spring

Product

Spring Security

External References

https://spring.io/security/cve-2026-22747

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment