A flaw in Spring Security’s SubjectX500PrincipalExtractor allows a malformed Common Name (CN) field in an X.509 client certificate to be parsed incorrectly. The component can read an unintended value as the authenticated username, enabling an attacker to impersonate any user for whom a valid certificate is not required.

Spring Security, versions 7.0.0 through 7.0.4.

The vulnerability carries a CVSS score of 6.8. EPSS data is not available, and it is not listed in the CISA KEV catalog. Exploitation requires an application that accepts X.509 client certificates. An attacker would need to supply a specially crafted certificate; if successful, the victim’s session would be bound to the forged identity, allowing access to resources they normally could not reach. No public exploit is currently known, but the nature of the attack vector and the moderate CVSS rating suggests that it could be actively leveraged in targeted or automated attacks.