Overview
About vulnerability
X509AuthenticationProvider could issue a fully authenticated X509AuthenticationToken when a presented certificate mapped to UserDetails, without applying Spring Security’s standard account lifecycle checks (disabled, locked, expired, or credentials-expired accounts). That behavior applied to users resolved from X509AuthoritiesPopulator and to cached entries, so accounts that should be rejected could still authenticate when mutual TLS or certificate-based SOAP authentication was in use.
Preconditions include certificate-based authentication wired through Spring WS X.509 integration with Spring Security, and user records in a non-active security state that should not authenticate.