CVE-2026-40995: Spring Web Services X509 Authentication Bypass Accounting Lifecycle Checks

Technical summary

The X509AuthenticationProvider in Spring Web Services fails to invoke Spring Security's standard account lifecycle validation methods when processing X509AuthenticationToken objects. After mapping a presented certificate to UserDetails, the provider issues a fully authenticated token without calling the appropriate checks that verify account status flags (enabled, accountNonLocked, accountNonExpired, credentialsNonExpired). This allows authentication to succeed for accounts that should be denied access due to administrative lockout, expiration, or credential age policies.

Business impact

Organizations relying on certificate-based authentication with Spring Web Services may unexpectedly grant access to users whose accounts have been administratively disabled or locked. This could expose APIs and web services to former employees or compromised certificate holders whose accounts were deactivated but whose certificates remain valid. Compliance frameworks requiring revocation of inactive user access may be violated, and incident response efforts could be complicated if disabled accounts can still authenticate via certificate.

Affected systems

Spring Web Services versions 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1 are affected. Any deployment using X509-based authentication with these versions should be considered at risk. Systems using other authentication mechanisms in Spring Web Services are not affected by this specific flaw.

Exploitability

Exploitation requires an attacker to possess a valid X509 certificate that maps to a user account in the system. The attacker does not need to know passwords or bypass additional authentication factors. The vulnerability is straightforward to exploit once a certificate is obtained—authentication will succeed immediately without requiring interaction with disabled accounts or triggering alerts tied to standard account validation. The CVSS vector (AV:N/AC:L/PR:L) indicates network accessibility and low attack complexity, with low privilege required because the attacker must have a valid certificate identity.

Remediation

Apply security updates from Spring Web Services that restore standard account lifecycle checks to the X509AuthenticationProvider. Review and update your Spring Web Services deployments to the patched versions. Organizations should verify that patches are available and deployed in all environments using X509 authentication. Additionally, conduct a review of active certificates and disable or revoke any that correspond to inactive or locked user accounts.

Patch guidance

Consult the official Spring Web Services security advisories and release notes for patched versions addressing CVE-2026-40995. Patches should be available for the 3.1.x, 4.0.x, 4.1.x, and 5.0.x release lines. Before patching, test in a non-production environment to ensure compatibility with your certificate validation and account management policies. Verify that the patched version re-enables the account lifecycle checks and that authentication denies access for disabled or locked accounts, even with valid certificates.

Detection guidance

Monitor authentication logs for successful certificate-based logins to accounts that should be disabled, locked, or have expired credentials. Implement alerting if X509AuthenticationProvider issues tokens for accounts with non-standard status flags. Review certificate mappings and validate that active certificates correspond only to active user accounts. Check for unexpected authentications from former employees or revoked users. Log analysis should correlate X509 certificate subject information with account status at the time of authentication.

Why prioritize this

Although the CVSS score is MEDIUM (5.4), this vulnerability poses a meaningful risk because it directly undermines access control decisions made by system administrators. Any environment using certificate authentication must ensure that account lifecycle policies are enforced; bypassing them could lead to unauthorized access by deactivated users. Organizations with strict access revocation requirements or those handling sensitive data should prioritize patching this issue promptly, particularly if they cannot immediately verify that all disabled accounts have had their certificates revoked.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a network-accessible flaw with low attack complexity and low privileges required (the attacker must have a valid certificate). The impact is limited to confidentiality and integrity (no availability impact), and the scope is unchanged. The score appropriately captures that while the vulnerability is exploitable, it requires prior possession of a valid certificate and affects a subset of deployments using X509 authentication. However, the score does not fully weight the organizational risk of bypassing deliberate account access controls, which may justify elevated priority in your risk model.

Frequently asked questions