Spring Web Services: X.509 authentication bypasses Spring Security account checks

🗓️ 11 Jun 2026 09:31:56Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 3 Views

X.509 auth in Spring Web Services bypasses Spring Security account lifecycle checks.

Reporter	Title	Published	Views	Family All 13
Circl	CVE-2026-40995	11 Jun 202612:40	–	circl
CNNVD	VMware Spring Web Services 授权问题漏洞	11 Jun 202600:00	–	cnnvd
CVE	CVE-2026-40995	11 Jun 202605:04	–	cve
Cvelist	CVE-2026-40995 X.509 authentication bypasses Spring Security account checks	11 Jun 202605:04	–	cvelist
EUVD	EUVD-2026-36205	11 Jun 202605:04	–	euvd
F5 Networks	K000162893: Spring Web Services vulnerability CVE-2026-40995	12 Aug 202617:10	–	f5
NVD	CVE-2026-40995	11 Jun 202607:16	–	nvd
OSV	GHSA-6MFM-98WV-32WM Spring Web Services: X.509 authentication bypasses Spring Security account checks	11 Jun 202609:31	–	osv
Positive Technologies	PT-2026-48618	11 Jun 202600:00	–	ptsecurity
Snyk	Incorrect Implementation of Authentication Algorithm	10 Jun 202600:00	–	snyk

Vulners

Node

OR

org.springframework.ws spring-ws-securityRange3.1.0–3.1.8maven

org.springframework.ws spring-ws-securityRange4.0.0–4.0.18maven

org.springframework.ws spring-ws-securityRange4.1.0–4.1.3maven

org.springframework.ws spring-ws-securityRange5.0.0–5.0.1maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-40995
spring	www.spring.io/security/cve-2026-40995
github	www.github.com/spring-projects/spring-ws/commit/e5dc311359e14f5b25bcb33f20d43cc3513e9d10
github	www.github.com/advisories/GHSA-6mfm-98wv-32wm

21 Aug 2026 19:12Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15.4

EPSS0.00148

SSVC

Spring Web Services X.509 authentication authentication bypass account lifecycle checks X509AuthenticationProvider