Description

X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security’s standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts). That behavior applied to users resolved from X509AuthoritiesPopulator and to cached entries, so accounts that should be rejected could still authenticate when mutual TLS or certificate-based SOAP authentication was in use.

Preconditions include certificate-based authentication wired through Spring WS X.509 integration with Spring Security, and user records in a non-active security state that should not authenticate.

Affected Spring Products and Versions

Spring Web Services:

• 5.0.0 - 5.0.1
• 4.1.0 - 4.1.3
• 4.0.0 - 4.0.18
• 3.1.0 - 3.1.8

Versions that are no longer supported are also affected.

Mitigation

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

References

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N&version=3.1

History

• 2026-06-10: Initial vulnerability report published.