THREAT OPS › Threat News › [NVD] CVE-2026-40995 (MEDIUM 5.4) — X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Affected ve
[NVD] CVE-2026-40995 (MEDIUM 5.4) — X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts). Affected ve
CVE-2026-40995 CVSS: 5.4 MEDIUM Published: 2026-06-11T07:16:27.430
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1
MITRE ATT&CK techniques
Indicators of compromise
- CVE-2026-40995cve
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-40995