The vulnerability CVE-2026-47838 in Spring Security involves improper authentication due to the SubjectDnX509PrincipalExtractor component mishandling malformed X.509 certificate CN values. This mishandling can lead to the extraction of an incorrect username from the certificate, enabling an attacker who crafts a malicious certificate to impersonate another user. The affected versions include Spring Security 5.7.0 through 5.7.24, 5.8.0 through 5.8.26, 6.3.0 through 6.3.17, 6.4.0 through 6.4.17, and 6.5.0 through 6.5.10. There is no vendor advisory or patch information available at this time, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker to impersonate another user by exploiting the improper handling of malformed X.509 certificate CN values. This can lead to unauthorized access with the privileges of the impersonated user. The vulnerability does not impact availability but has high confidentiality and integrity impact as per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid trusting certificates from untrusted sources and consider additional authentication checks where possible to mitigate impersonation risks.