← Back

CVE-2026-40995

nvd nist
Published: Jun 11, 2026Modified: Sep 4, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Exploitability: 2.8 / Impact: 2.5
Source: security@vmware.com (Secondary)

Description

X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts). Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.

Affected (4)

Broadcom
1 product
Spring Web Services
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Broadcom
Spring Web Services
Before 3.1.9
Spring Web Services
From 4.0.0 to 4.0.19
Spring Web Services
From 4.1.0 to 4.1.3.1
Spring Web Services
From 5.0.0 to 5.0.1.1

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (1)

Source: security@vmware.com
Vendor Advisory

Timeline

No history available yet.