The vulnerability in Spring Web Services involves the X509AuthenticationProvider component issuing a fully authenticated X509AuthenticationToken when a presented certificate maps to UserDetails, but it fails to apply Spring Security's standard account lifecycle checks. These checks include verifying whether the user account is disabled, locked, expired, or has expired credentials. As a result, accounts that should be restricted due to their lifecycle state might still be authenticated successfully. The affected versions are Spring Web Services 5.0.0 through 5.0.1, 4.1.0 through 4.1.3, 4.0.0 through 4.0.18, and 3.1.0 through 3.1.8. No official patch or remediation guidance is currently provided by the vendor, and no known exploits are reported in the wild.

This vulnerability can lead to improper authentication where user accounts that are disabled, locked, expired, or have expired credentials may still be authenticated if the presented certificate maps to UserDetails. This undermines the intended security controls around account lifecycle management, potentially allowing unauthorized access with limited privileges. The CVSS score of 5.4 (medium severity) reflects a network attack vector with low complexity and low privileges required, impacting confidentiality and integrity but not availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should review their use of X509AuthenticationProvider and consider additional custom checks to enforce account lifecycle status. Monitoring for unusual authentication activity related to certificate-based logins may help detect exploitation attempts.