CVE-2026-40995

Name of the Vulnerable Software and Affected Versions Spring Web Services versions 5.0.0 through 5.0.1 Spring Web Services versions 4.1.0 through 4.1.3 Spring Web Services versions 4.0.0 through 4.0.18 Spring Web Services versions 3.1.0 through 3.1.8

Description X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying standard account lifecycle checks. This means accounts that are disabled, locked, expired, or have expired credentials could still be authenticated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.