The vulnerability CVE-2026-40995 in Spring Web Services arises from the X509AuthenticationProvider component, which may issue a fully authenticated X509AuthenticationToken if a presented certificate maps to UserDetails, but fails to apply Spring Security's standard account lifecycle checks (including disabled, locked, expired, or credentials-expired states). This improper authentication weakness (CWE-287) affects multiple versions of Spring Web Services: 3.1.0 through 3.1.8, 4.0.0 through 4.0.18, 4.1.0 through 4.1.3, and 5.0.0 through 5.0.1. The CVSS v3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, requiring low privileges, no user interaction, and limited confidentiality and integrity impact. No official remediation or patch is currently documented.

An attacker presenting a certificate mapped to a user could receive a fully authenticated token without the system verifying if the user account is disabled, locked, expired, or has expired credentials. This could lead to unauthorized access to resources protected by Spring Web Services, potentially compromising confidentiality and integrity of data accessible through the affected service. However, the impact is limited to the scope of authentication bypass and does not affect availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider additional compensating controls around certificate validation and account lifecycle enforcement outside of the vulnerable component. Monitoring for unusual authentication activity may help detect exploitation attempts. Avoid relying solely on X509AuthenticationProvider for authentication in affected versions.