org.springframework.security:spring-security-config 5.3.10.RELEASE

Direct Vulnerabilities

Known vulnerabilities in the org.springframework.security:spring-security-config package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H User Impersonation org.springframework.security:spring-security-config is a security configuration package for Spring Framework. Affected versions of this package are vulnerable to User Impersonation via username extraction in `SubjectDnX509PrincipalExtractor`. An attacker can impersonate another user by presenting a specially crafted X.509 certificate containing a malformed Common Name (CN) value that causes the extractor to resolve an incorrect username during certificate-based authentication. Note: This vulnerability is a continuation of CVE-2026-22747, which addressed the same issue in Spring Security 7.0.x. Exploitation requires compromise or misuse of a trusted upstream certificate validation process, as this component operates within Spring Security's pre-authentication flow and assumes presented certificates have already been validated. How to fix User Impersonation? Upgrade `org.springframework.security:spring-security-config` to version 6.5.11 or higher.	[,6.5.11)
M Authorization Bypass org.springframework.security:spring-security-config is a security configuration package for Spring Framework. Affected versions of this package are vulnerable to Authorization Bypass due to the use of `String.toLowerCase()` and `String.toUpperCase()` that have `Locale` dependent exceptions, which results in authorization rules not working properly. How to fix Authorization Bypass? Upgrade `org.springframework.security:spring-security-config` to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.	[,5.7.14)[5.8.0,5.8.16)[6.2.0,6.2.8)[6.3.0,6.3.5)

Vulnerability

Vulnerable Version

User Impersonation

org.springframework.security:spring-security-config is a security configuration package for Spring Framework.

Affected versions of this package are vulnerable to User Impersonation via username extraction in SubjectDnX509PrincipalExtractor. An attacker can impersonate another user by presenting a specially crafted X.509 certificate containing a malformed Common Name (CN) value that causes the extractor to resolve an incorrect username during certificate-based authentication.

Note:

This vulnerability is a continuation of CVE-2026-22747, which addressed the same issue in Spring Security 7.0.x.
Exploitation requires compromise or misuse of a trusted upstream certificate validation process, as this component operates within Spring Security's pre-authentication flow and assumes presented certificates have already been validated.

How to fix User Impersonation?

Upgrade org.springframework.security:spring-security-config to version 6.5.11 or higher.

[,6.5.11)

Authorization Bypass

org.springframework.security:spring-security-config is a security configuration package for Spring Framework.

Affected versions of this package are vulnerable to Authorization Bypass due to the use of String.toLowerCase() and String.toUpperCase() that have Locale dependent exceptions, which results in authorization rules not working properly.

How to fix Authorization Bypass?

Upgrade org.springframework.security:spring-security-config to version 5.7.14, 5.8.16, 6.2.8, 6.3.5 or higher.

[,5.7.14)[5.8.0,5.8.16)[6.2.0,6.2.8)[6.3.0,6.3.5)

org.springframework.security:spring-security-config@5.3.10.RELEASE

latest version

latest non vulnerable version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically