An authentication bypass exists in `X509Authenticator` and `X509AuthenticationListener` where an attacker possessing a certificate from a trusted CA can authenticate as an arbitrary user, including privileged accounts, by influencing the Common Name (CN). The issue stems from an incomplete fix where the regular expression used to extract user identifiers from the Subject DN (Distinguished Name) passed in `$ SERVER['SSL CLIENT S DN']` was not escape-aware. Consequently, the system fails to distinguish between actual RDN (Relative Distinguished Name) separators and separator characters contained within a value. Under RFC 2253, escaped commas are incorrectly read as separators, and bare slashes are treated as separators. In the legacy `X509 NAME oneline()` format, bare commas are treated as separators. This allows a poisoned CN to smuggle a different user address for authentication.