CVE-2026-93302
Received Received - Intake

wolfSSL Peer Certificate Verification Bypass

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: wolfSSL Inc.

Description
MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEER_CERT and load CA certificates with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). The peer must know the certificates being loaded to either of those APIs to take advantage of the issue. When OPENSSL_COMPATIBLE_DEFAULTS is also defined this widens the affected API to include all CA certificate loading. Both macros are defined when using autoconf builds such as (nginx, haproxy, stunnel, wpas, apache httpd, hitch, bind, rsyslog, ffmpeg, all, distro). When the certificate is listed as a trusted peer certificate the issue previously allowed for a malicious (D)TLS server to bypass authentication once knowing which CA’s the client would accept. This also affects mutual authentication cases where the client knows which CA’s the server has loaded. If building with any of these configurations and using (D)TLS where the loaded CA’s could be known and authentication of the peer is desired, users should either: update to the latest wolfSSL version, apply the fix patch, or use the configure flag --disable-openssl-compatible-defaults and not load CA’s with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert() to mitigate the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-93302
EUVD
EUVD-2026-87910

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wolfssl wolfssl *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in wolfSSL allows a malicious (D)TLS server to bypass authentication by forging a CA clone. It occurs when the WOLFSSL_TRUST_PEER_CERT macro is enabled and CA certificates are loaded via wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). The issue arises because the system only verifies subject name hash, issuer hash, and SKID, not the full certificate or public key.

Detection Guidance

To detect this vulnerability, check if your wolfSSL build includes the macros WOLFSSL_TRUST_PEER_CERT and OPENSSL_COMPATIBLE_DEFAULTS. Inspect the wolfSSL version and configuration flags used during compilation. Verify if CA certificates are loaded via wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert().

Commands to check: grep -r WOLFSSL_TRUST_PEER_CERT /path/to/wolfssl/config; grep -r OPENSSL_COMPATIBLE_DEFAULTS /path/to/wolfssl/config; ldd /path/to/application | grep wolfssl

Impact Analysis

If exploited, an attacker could impersonate a trusted server, leading to unauthorized access or data interception. Systems using autoconf builds (nginx, haproxy, etc.) with default settings are particularly vulnerable. Mutual authentication cases are also affected if the client knows the server's loaded CA certificates.

Compliance Impact

This vulnerability could undermine compliance with GDPR and HIPAA by allowing forged CA clones to bypass authentication in TLS/DTLS connections. If exploited, it may enable unauthorized access to sensitive data, violating confidentiality requirements under these regulations.

Mitigation Strategies

Update wolfSSL to the latest version or apply the fix patch. Alternatively, disable OPENSSL_COMPATIBLE_DEFAULTS using --disable-openssl-compatible-defaults during configuration and avoid loading CA certificates with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert().

For autoconf builds (nginx, haproxy, etc.), rebuild with the updated wolfSSL library or the provided patch.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93302. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart