The vulnerability in Spring Security affects the SubjectX500PrincipalExtractor, which does not correctly process certain malformed Common Name (CN) values in X.509 certificates. This improper handling can result in the extraction of an incorrect username from the certificate. An attacker who crafts a malicious certificate exploiting this flaw may be able to impersonate another user within the system. The issue impacts Spring Security versions from 7.0.0 through 7.0.4. The CVSS v3.1 base score is 6.8, indicating a medium severity with network attack vector, high complexity, low privileges required, no user interaction, and high confidentiality and integrity impact but no availability impact. No official patch or remediation level is indicated in the provided data. The Red Hat advisory URL is provided but does not explicitly state patch availability or mitigation steps.

An attacker can exploit this vulnerability by presenting a specially crafted X.509 certificate with malformed CN values to cause the system to read an incorrect username. This can lead to impersonation of another user, compromising confidentiality and integrity of user identity within affected Spring Security applications. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-22747 for current remediation guidance. Until an official fix is available, avoid trusting certificates from untrusted sources and consider additional validation of certificate CN values in application logic if feasible.