CVE-2026-40995
X.509 authentication bypasses Spring Security account checks
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
X.509 authentication bypasses Spring Security account checks
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40995- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2026-36205
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
EUVD-2026-36205- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6mfm-98wv-32wm
Spring Web Services: X.509 authentication bypasses Spring Security account checks
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
GHSA-6mfm-98wv-32wm- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40995- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
X.509 authentication bypasses Spring Security account checks
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
CVE-2026-40995- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-6mfm-98wv-32wm
Spring Web Services: X.509 authentication bypasses Spring Security account checks
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
- Record
GHSA-6mfm-98wv-32wm- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
Show 15 moreShow less
OSVCLSA-2026-1791320385 No score
TuxCare security update for org.springframework.ws (6 CVEs)
TuxCare rebuilt 2 org.springframework.ws packages to address 6 CVEs. Fixed in 4.0.15-tuxcare.2.
- Record
CLSA-2026-1791320385- Updated
- 2026-11-02
OSVCLSA-2026-1791815784 No score
TuxCare security update for org.springframework.ws:spring-ws-security (5 CVEs)
TuxCare rebuilt org.springframework.ws:spring-ws-security to address 5 CVEs. Fixed in 4.0.17-tuxcare.6.
- Record
CLSA-2026-1791815784- Updated
- 2026-11-02
OSVCLSA-2026-1791841427 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.8-tuxcare.1.
- Record
CLSA-2026-1791841427- Updated
- 2026-11-02
OSVCLSA-2026-1791842265 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.8-tuxcare.4.
- Record
CLSA-2026-1791842265- Updated
- 2026-11-02
OSVCLSA-2026-1791878893 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.10.RELEASE-tuxcare.1.
- Record
CLSA-2026-1791878893- Updated
- 2026-11-02
OSVCLSA-2026-1791879222 No score
TuxCare security update for org.springframework.ws:spring-ws-security (5 CVEs)
TuxCare rebuilt org.springframework.ws:spring-ws-security to address 5 CVEs. Fixed in 4.0.14-tuxcare.2.
- Record
CLSA-2026-1791879222- Updated
- 2026-11-02
OSVCLSA-2026-1791879447 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.6-tuxcare.2.
- Record
CLSA-2026-1791879447- Updated
- 2026-11-02
OSVCLSA-2026-1791895043 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.1.7-tuxcare.1.
- Record
CLSA-2026-1791895043- Updated
- 2026-11-02
OSVCLSA-2026-1791896844 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.11-tuxcare.1.
- Record
CLSA-2026-1791896844- Updated
- 2026-11-02
OSVCLSA-2026-1791897718 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 4.0.10-tuxcare.1.
- Record
CLSA-2026-1791897718- Updated
- 2026-11-02
OSVCLSA-2026-1791898135 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 3.0.7.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791898135- Updated
- 2026-11-02
OSVCLSA-2026-1791901615 No score
TuxCare security update for org.springframework.ws (7 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 7 CVEs. Fixed in 2.4.5.RELEASE-tuxcare.2.
- Record
CLSA-2026-1791901615- Updated
- 2026-11-02
OSVCLSA-2026-1793839298 No score
TuxCare security update for org.springframework.ws (5 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 3.1.4-tuxcare.3.
- Record
CLSA-2026-1793839298- Updated
- 2026-11-05
OSVCLSA-2026-1793859202 No score
TuxCare security update for org.springframework.ws (5 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 3.1.5-tuxcare.3.
- Record
CLSA-2026-1793859202- Updated
- 2026-11-05
OSVCLSA-2026-1793889628 No score
TuxCare security update for org.springframework.ws (5 CVEs)
TuxCare rebuilt 3 org.springframework.ws packages to address 5 CVEs. Fixed in 4.0.16-tuxcare.2.
- Record
CLSA-2026-1793889628- Updated
- 2026-11-06
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.ws:spring-ws-securityMaven |
5.0.0 to 5.0.1 | 5.0.2 |
org.springframework.ws:spring-ws-securityMaven |
4.1.0 to 4.1.3 | 4.1.4 |
org.springframework.ws:spring-ws-securityMaven |
4.0.0 to 4.0.18 | None known |
org.springframework.ws:spring-ws-securityMaven |
3.1.0 to 3.1.8 | None known |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 6 CVEs |
4.0.15 up to 4.0.15-tuxcare.2, plus listed versions 4.0.15-tuxcare.1 |
4.0.15-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 6 CVEs |
4.0.15 up to 4.0.15-tuxcare.2, plus listed versions 4.0.15-tuxcare.1 |
4.0.15-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
4.0.17 up to 4.0.17-tuxcare.6, plus listed versions 4.0.17-tuxcare.14.0.17-tuxcare.24.0.17-tuxcare.34.0.17-tuxcare.44.0.17-tuxcare.5 |
4.0.17-tuxcare.6 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.8 up to 4.0.8-tuxcare.1 | 4.0.8-tuxcare.1 |
Show 38 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.8 up to 3.1.8-tuxcare.4, plus listed versions 3.1.8-tuxcare.33.1.8.tuxcare3.1.8.tuxcare.2 |
3.1.8-tuxcare.4 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.0.10.RELEASE up to 3.0.10.RELEASE-tuxcare.1 | 3.0.10.RELEASE-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
4.0.14 up to 4.0.14-tuxcare.2, plus listed versions 4.0.14-tuxcare.1 |
4.0.14-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.6 up to 3.1.6-tuxcare.2, plus listed versions 3.1.6-tuxcare.1 |
3.1.6-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.1.7 up to 3.1.7-tuxcare.1 | 3.1.7-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.11 up to 4.0.11-tuxcare.1 | 4.0.11-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
4.0.10 up to 4.0.10-tuxcare.1 | 4.0.10-tuxcare.1 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
3.0.7.RELEASE up to 3.0.7.RELEASE-tuxcare.2, plus listed versions 3.0.7.RELEASE-tuxcare.1 |
3.0.7.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 7 CVEs |
2.4.5.RELEASE up to 2.4.5.RELEASE-tuxcare.2, plus listed versions 2.4.5.RELEASE-tuxcare.1 |
2.4.5.RELEASE-tuxcare.2 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 5 CVEs |
3.1.4 up to 3.1.4-tuxcare.3, plus listed versions 3.1.4-tuxcare.13.1.4-tuxcare.2 |
3.1.4-tuxcare.3 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
3.1.4 up to 3.1.4-tuxcare.3, plus listed versions 3.1.4-tuxcare.13.1.4-tuxcare.2 |
3.1.4-tuxcare.3 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 5 CVEs |
3.1.4 up to 3.1.4-tuxcare.3, plus listed versions 3.1.4-tuxcare.13.1.4-tuxcare.2 |
3.1.4-tuxcare.3 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 5 CVEs |
3.1.5 up to 3.1.5-tuxcare.3, plus listed versions 3.1.5-tuxcare.13.1.5-tuxcare.2 |
3.1.5-tuxcare.3 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
3.1.5 up to 3.1.5-tuxcare.3, plus listed versions 3.1.5-tuxcare.13.1.5-tuxcare.2 |
3.1.5-tuxcare.3 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 5 CVEs |
3.1.5 up to 3.1.5-tuxcare.3, plus listed versions 3.1.5-tuxcare.13.1.5-tuxcare.2 |
3.1.5-tuxcare.3 |
org.springframework.ws:spring-ws-coreTuxCare:Maven From an advisory covering 5 CVEs |
4.0.16 up to 4.0.16-tuxcare.2, plus listed versions 4.0.16-tuxcare.1 |
4.0.16-tuxcare.2 |
org.springframework.ws:spring-ws-securityTuxCare:Maven From an advisory covering 5 CVEs |
4.0.16 up to 4.0.16-tuxcare.2, plus listed versions 4.0.16-tuxcare.1 |
4.0.16-tuxcare.2 |
org.springframework.ws:spring-xmlTuxCare:Maven From an advisory covering 5 CVEs |
4.0.16 up to 4.0.16-tuxcare.2, plus listed versions 4.0.16-tuxcare.1 |
4.0.16-tuxcare.2 |
org.springframework.ws:spring-ws-securityMaven |
5.0.0 up to 5.0.2, plus listed versions 5.0.1 |
5.0.2 |
org.springframework.ws:spring-ws-securityMaven |
4.1.0 up to 4.1.4, plus listed versions 4.1.14.1.24.1.3 |
4.1.4 |
org.springframework.ws:spring-ws-securityMaven |
4.0.0 to 4.0.18, plus listed versions 4.0.14.0.104.0.114.0.124.0.13 Show 12 moreShow less4.0.144.0.154.0.164.0.174.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.9 |
None known |
org.springframework.ws:spring-ws-securityMaven |
3.1.0 to 3.1.8, plus listed versions 3.1.13.1.23.1.33.1.43.1.53.1.63.1.7 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| affected | ||
| affected, aliases | OSV | |
| affected, aliases, facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40995 is a medium vulnerability (CVSS 5.4) in Broadcom Spring Web Services, published June 11, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.15%, the 4th percentile. Fixed in org.springframework.ws:spring-ws-security 5.0.2.
References
spring.io/security/cve-2026-40995
nvd.nist.gov/vuln/detail/CVE-2026-40995
github.com/spring-projects/spring-ws/commit/e5dc311359e14f5b25bcb33f20d43cc3513e9d10