X509AuthenticationProvider can generate a fully authenticated X509AuthenticationToken for any certificate that maps to a UserDetails object while skipping the standard Spring Security account lifecycle checks. This flaw is an authentication bypass (CWE-287) and permits an attacker to authenticate as a disabled, locked, expired, or credentials‑expired account, enabling unauthorized access to protected application resources.

The vulnerability impacts multiple releases of Spring Web Services: 5.0.0 through 5.0.1; 4.1.0 through 4.1.3; 4.0.0 through 4.0.18; 3.1.0 through 3.1.8. These versions are commonly used to provide security for applications that rely on Spring Web Services.

The CVSS score of 5.4 classifies the flaw as moderate in severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been reported. The attack vector is inferred: an attacker must obtain a certificate that the application maps to a UserDetails instance and must have network access to a service performing X509 authentication. While the flaw does not provide arbitrary code execution or domain‑wide privilege escalation, bypassing the account checks can expose sensitive APIs or data to an account that should have been blocked.