CVE-2026-40995 X.509 authentication bypasses Spring Security account checks
Attackers with valid certificates can bypass account status checks like disabled or locked states in Spring Web Services.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40995?
CVE-2026-40995 is a medium-severity authentication bypass vulnerability in Spring Web Services, published on 11 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security's standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts).
Affected versions: Spring Web Services 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8.
Weakness: CWE-287
Which versions are affected by CVE-2026-40995?
8 open source packages ship an affected version, including org.springframework.ws:spring-ws-security. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.springframework.ws:spring-ws-security Maven | From 3.1.0 to 3.1.8 | None |
org.springframework.ws:spring-ws-security Maven | From 3.1.0 to 3.1.8 | None |
org.springframework.ws:spring-ws-security Maven | From 4.0.0 to 4.0.18 | None |
org.springframework.ws:spring-ws-security Maven | From 4.0.0 to 4.0.18 | None |
org.springframework.ws:spring-ws-security Maven | From 4.1.0 | 4.1.4 |
org.springframework.ws:spring-ws-security Maven | From 4.1.0 | 4.1.4 |
2 more packages
org.springframework.ws:spring-ws-security Maven | From 5.0.0 | 5.0.2 |
org.springframework.ws:spring-ws-security Maven | From 5.0.0 | 5.0.2 |
Products include Broadcom Spring Web Services.
How do I fix CVE-2026-40995?
Upgrade org.springframework.ws:spring-ws-security to a fixed version for your release line: 4.1.4 or 5.0.2.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-40995 being exploited?
There is no known exploitation of CVE-2026-40995 in the wild and no public exploit code.
Other vulnerabilities in Spring Web Services
- CVE-2019-3773 Spring Web Services XML External Entity Injection (XXE)
- CVE-2026-40999 Spring WS SSRF via unvalidated WS-Addressing reply destinations
- CVE-2026-40994 Wss4jSecurityInterceptor disables WS-I BSP validation by default
- CVE-2026-40998 Jaxp13 XPath XXE via StreamSource and SAXSource
- CVE-2026-40997 SOAP security faults leak Spring Security account state
Sources
Also known as GHSA-6mfm-98wv-32wm.