The vulnerability in Spring Security arises from improper handling of malformed X.509 certificate Common Name (CN) values by the SubjectX500PrincipalExtractor. This can lead to the extraction of an incorrect username from the certificate, enabling an attacker who crafts a specific certificate to impersonate another user. The issue affects versions 7.0.0 through 7.0.4. The CVSS 3.1 base score is 6.8 with network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity but no impact on availability.

An attacker who can present a specially crafted X.509 certificate may be able to impersonate another user by causing the system to read an incorrect username value. This can lead to unauthorized access and compromise of user identity within affected Spring Security applications. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor Spring's official channels for updates. Until a fix is available, consider restricting or validating certificate inputs to mitigate the risk of malformed certificates causing impersonation.