CVE-2026-78134
Received Received - Intake

Incorrect Access Control in strongSwan eap-ttls and eap-peap Plugins

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: MITRE

Description
strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-78134
EUVD
EUVD-2026-75920

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
strongswan strongswan From 4.5.0 (inc) to 6.0.7 (inc)
strongswan strongswan 6.1.0
strongswan strongswan 5.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in strongSwan affects versions 4.5.0 through 6.0.7. It involves incorrect access control in the eap-ttls and eap-peap plugins where inner EAP identity details are mismatched or missing. This can lead to identity binding errors and authorization bypasses.

Detection Guidance

Check if strongSwan versions 4.5.0 through 6.0.7 are installed. Inspect logs for EAP-PEAP or EAP-TTLS authentication failures. Use strongSwan's 'ipsec status' command to verify loaded plugins. Monitor for mismatched inner EAP identities in authentication logs.

Impact Analysis

This vulnerability may allow an attacker to impersonate another user or manipulate authorization decisions, such as virtual IP assignment. However, remote code execution is not possible.

Compliance Impact

This vulnerability could lead to unauthorized access or identity impersonation, which may violate data protection requirements under GDPR or HIPAA. Incorrect authorization decisions could result in unauthorized data exposure or access, potentially breaching compliance with these regulations.

Mitigation Strategies

Avoid using EAP-PEAP or EAP-TTLS plugins. Ensure the eap-dynamic plugin is not loaded. Upgrade to strongSwan 6.1.0 or apply patches for versions 5.3.0 and later. Review and update authentication policies to enforce strict identity validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78134. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart