Common Weakness Enumeration

CWE-295

Weakness Allowed

Improper Certificate Validation

Abstraction: Base · Status: Draft

API response cwe.mitre.org

The product does not validate, or incorrectly validates, a certificate.

Mapping guidance

This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.

Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Relationships and members
ChildOf: CWE-287 · View CWE-1000
ChildOf: CWE-287 · View CWE-1003
PeerOf: CWE-322 (symmetric) · View CWE-1000
Modes of introduction
Architecture and Design
Implementation

REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Implementation

When the product uses certificate pinning, the developer might not properly validate all relevant components of the certificate before pinning the certificate. This can make it difficult or expensive to test after the pinning is complete.

Detection methods

Automated Static Analysis - Binary or Bytecode

According to SOAR [REF-1479], the following detection techniques may be useful:

Cost effective for partial coverage:

Bytecode Weakness Analysis - including disassembler + source code weakness analysis

Binary Weakness Analysis - including disassembler + source code weakness analysis

Effectiveness: SOAR Partial

Manual Static Analysis - Binary or Bytecode

According to SOAR [REF-1479], the following detection techniques may be useful:

Cost effective for partial coverage:

Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies

Effectiveness: SOAR Partial

Dynamic Analysis with Automated Results Interpretation

According to SOAR [REF-1479], the following detection techniques may be useful:

Cost effective for partial coverage:

Web Application Scanner

Effectiveness: SOAR Partial

Dynamic Analysis with Manual Results Interpretation

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Man-in-the-middle attack tool

Effectiveness: High

Manual Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Focused Manual Spotcheck - Focused manual analysis of source

Manual Source Code Review (not inspections)

Effectiveness: High

Automated Static Analysis - Source Code

According to SOAR [REF-1479], the following detection techniques may be useful:

Cost effective for partial coverage:

Source code Weakness Analyzer

Context-configured Source Code Weakness Analyzer

Effectiveness: SOAR Partial

Architecture or Design Review

According to SOAR [REF-1479], the following detection techniques may be useful:

Highly cost effective:

Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)

Effectiveness: High

Content history
Submission: CWE Community · 2006-07-19 · CWE Draft 3

Submitted by members of the CWE community to extend early CWE versions

Modification: · Veracode · 2008-08-15 · CWE 1.0

Suggested OWASP Top Ten 2004 mapping

Modification: CWE Content Team · MITRE · 2008-09-08 · CWE 1.0

updated Relationships, Taxonomy_Mappings

Modification: CWE Content Team · MITRE · 2008-10-14 · CWE 1.0.1

updated Background_Details, Description

Modification: CWE Content Team · MITRE · 2012-05-11 · CWE 2.2

updated Related_Attack_Patterns

Modification: CWE Content Team · MITRE · 2012-12-28 · CWE 2.4

Converted from category to weakness class.

Modification: CWE Content Team · MITRE · 2013-02-21 · CWE 2.4

updated Applicable_Platforms, Common_Consequences, Description, Name, Observed_Examples, Potential_Mitigations, References, Relationships, Time_of_Introduction, Type

Modification: CWE Content Team · MITRE · 2014-06-23 · CWE 2.7

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2014-07-30 · CWE 2.8

updated Detection_Factors

Modification: CWE Content Team · MITRE · 2015-12-07 · CWE 2.9

updated Relationships

Modification: CWE Content Team · MITRE · 2017-01-19 · CWE 2.10

updated Relationships

Modification: CWE Content Team · MITRE · 2017-11-08 · CWE 3.0

updated Modes_of_Introduction, References, Relationships

Modification: CWE Content Team · MITRE · 2018-03-27 · CWE 3.1

updated Background_Details, Modes_of_Introduction, Potential_Mitigations, Relationships

Modification: CWE Content Team · MITRE · 2019-06-20 · CWE 3.3

updated Relationships

Modification: CWE Content Team · MITRE · 2019-09-19 · CWE 3.4

updated Demonstrative_Examples, Relationships

Modification: CWE Content Team · MITRE · 2020-02-24 · CWE 4.0

updated Applicable_Platforms, Demonstrative_Examples, Description, Observed_Examples, Relationships

Modification: CWE Content Team · MITRE · 2020-08-20 · CWE 4.2

updated Related_Attack_Patterns

Modification: CWE Content Team · MITRE · 2021-07-20 · CWE 4.5

updated Demonstrative_Examples, Observed_Examples

Modification: CWE Content Team · MITRE · 2021-10-28 · CWE 4.6

updated Observed_Examples, Relationships

Modification: CWE Content Team · MITRE · 2022-04-28 · CWE 4.7

updated Relationships

Modification: CWE Content Team · MITRE · 2022-10-13 · CWE 4.9

updated Observed_Examples, References

Modification: CWE Content Team · MITRE · 2023-01-31 · CWE 4.10

updated Description, Modes_of_Introduction

Modification: CWE Content Team · MITRE · 2023-04-27 · CWE 4.11

updated Relationships

Modification: CWE Content Team · MITRE · 2023-06-29 · CWE 4.12

updated Mapping_Notes

Modification: CWE Content Team · MITRE · 2025-09-09 · CWE 4.18

updated Common_Consequences, Description, Detection_Factors, Diagram, References

Modification: CWE Content Team · MITRE · 2025-12-11 · CWE 4.19

updated Applicable_Platforms, Observed_Examples, Relationships, Weakness_Ordinalities

Modification: CWE Content Team · MITRE · 2026-04-30 · CWE 4.20

updated Observed_Examples

Modification: CWE Content Team · MITRE · 2026-10-28 · CWE 5.0

updated Applicable_Platforms, Observed_Examples, References, Relationships, Taxonomy_Mappings

2474 vulnerabilities reference this CWE, most recent first.

CVE-2026-122318 (GCVE-0-2026-122318)

Vulnerability from cvelistv5 – Published: 2026-11-05 02:25 – Updated: 2026-11-05 02:25
VLAI
Title
Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates
Summary
Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning.
Severity
7.2 (High)
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L
7.7 (High)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7605 records in the last 180 days details
References
Impacted products
Vendor Product Version
kyverno kyverno Affected: 0 , < 1.19.2 (semver)
Unaffected: 1.19.2 (semver)
    cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-21 00:00
Credits
arpitjain099
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/kyverno/kyverno",
          "product": "kyverno",
          "vendor": "kyverno",
          "versions": [
            {
              "lessThan": "1.19.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.19.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "1.19.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "arpitjain099"
        }
      ],
      "datePublic": "2026-10-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Kyverno before 1.19.2 contains an authentication bypass in matchCertificateData that skips verifyImages subject and subjectRegExp checks when the signing certificate has no Subject Alternative Name. Attackers holding a leaf certificate from a configured private trust root can omit the SAN, set the expected Fulcio issuer OID, and sign malicious images that are admitted despite signer pinning."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T02:25:17.874Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-fcfr-fr8g-qjqv)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/kyverno/kyverno/security/advisories/GHSA-fcfr-fr8g-qjqv"
        },
        {
          "name": "VulnCheck Advisory: Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/kyverno-before-1.19.2-cosign-identity-check-bypass-via-empty-san-certificates"
        }
      ],
      "title": "Kyverno before 1.19.2 Cosign Identity Check Bypass via Empty SAN Certificates",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-122318",
    "datePublished": "2026-11-05T02:25:17.874Z",
    "dateReserved": "2026-11-04T23:25:07.316Z",
    "dateUpdated": "2026-11-05T02:25:17.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121638 (GCVE-0-2026-121638)

Vulnerability from cvelistv5 – Published: 2026-11-04 14:44 – Updated: 2026-11-04 18:20
VLAI
Title
WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks
Summary
An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.
Severity
9.1 (Critical)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 16:38 UTC
CWE
Assigner
WatchGuard CNA under the mitre root
CNA scorecard A 91/100 over 92 records in the last 180 days details
References
Impacted products
Vendor Product Version
WatchGuard AuthPoint Authentication Gateway Affected: 1.0 , < 7.6.0 (semver)
    cpe:2.3:a:watchguard:authpoint_authentication_gateway:*:*:*:*:*:*:*:*
Create a notification for this product.
Credits
WatchGuard AI Security Research
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121638",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T16:38:45.464042Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T18:20:22.305Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "AuthPoint Authentication Gateway",
          "vendor": "WatchGuard",
          "versions": [
            {
              "lessThan": "7.6.0",
              "status": "affected",
              "version": "1.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThis vulnerability affects AuthPoint Gateway deployments configured with a RADIUS, LDAP or ADFS resource.\u003c/p\u003e"
            }
          ],
          "value": "This vulnerability affects AuthPoint Gateway deployments configured with a RADIUS, LDAP or ADFS resource."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:watchguard:authpoint_authentication_gateway:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.6.0",
                  "versionStartIncluding": "1.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "WatchGuard AI Security Research"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."
            }
          ],
          "value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T14:44:14.541Z",
        "orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
        "shortName": "WatchGuard"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://psirt.watchguard.com/CVE-2026-121638"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "AuthPoint Authentication Gateway 7.6.0"
            }
          ],
          "value": "AuthPoint Authentication Gateway 7.6.0"
        }
      ],
      "title": "WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
    "assignerShortName": "WatchGuard",
    "cveId": "CVE-2026-121638",
    "datePublished": "2026-11-04T14:44:14.541Z",
    "dateReserved": "2026-11-03T17:27:06.115Z",
    "dateUpdated": "2026-11-04T18:20:22.305Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121624 (GCVE-0-2026-121624)

Vulnerability from cvelistv5 – Published: 2026-11-03 17:13 – Updated: 2026-11-03 22:41
VLAI
Title
Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation
Summary
Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.
Severity
7.6 (High)
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
6.8 (Medium)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 22:36 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7605 records in the last 180 days details
References
Impacted products
Vendor Product Version
Nanosystems Supremo Affected: 0 , < 5.0.2.3874 (custom)
Create a notification for this product.
Date Public
2026-11-03 00:00
Credits
Andrea Pusineri
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121624",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T22:36:34.514075Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T22:41:14.021Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Supremo",
          "vendor": "Nanosystems",
          "versions": [
            {
              "lessThan": "5.0.2.3874",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrea Pusineri"
        }
      ],
      "datePublic": "2026-11-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client\u0027s TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T17:13:52.053Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://www.supremocontrol.com/changelog/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.supremocontrol.com/"
        },
        {
          "name": "VulnCheck Advisory: Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nanosystems-supremo-before-5.0.2.3874-improper-tls-certificate-validation"
        }
      ],
      "title": "Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-121624",
    "datePublished": "2026-11-03T17:13:52.053Z",
    "dateReserved": "2026-11-03T16:57:36.800Z",
    "dateUpdated": "2026-11-03T22:41:14.021Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121565 (GCVE-0-2026-121565)

Vulnerability from cvelistv5 – Published: 2026-11-03 22:17 – Updated: 2026-11-06 19:26
VLAI
Title
Tanium addressed an improper certificate validation vulnerability in multiple products
Summary
Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.
Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 19:26 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
Tanium CNA under the mitre root
CNA scorecard D 60/100 over 87 records in the last 180 days details
References
Impacted products
Vendor Product Version
Tanium TanOS Affected: 1.8.5 , < 1.8.5.0326 (custom)
Affected: 1.8.6 , < 1.8.6.0193 (custom)
Affected: 1.9.0 , < 1.9.0.0089 (custom)
Create a notification for this product.
Tanium Asset Affected: 1.33 , < 1.33.334 (custom)
Affected: 1.36 , < 1.36.182 (custom)
Affected: 1.39 , < 1.39.164 (custom)
Create a notification for this product.
Tanium Comply Affected: 2.32 , < 2.32.275 (custom)
Affected: 2.35 , < 2.35.337 (custom)
Affected: 2.37 , < 2.37.347 (custom)
Create a notification for this product.
Tanium Connect Affected: 5.29 , < 5.29.272 (custom)
Affected: 5.37 , < 5.37.177 (custom)
Affected: 5.47 , < 5.47.135 (custom)
Create a notification for this product.
Tanium Integrity Monitor Affected: 3.6 , < 3.6.608 (custom)
Affected: 3.7 , < 3.7.383 (custom)
Affected: 3.8 , < 3.8.362 (custom)
Create a notification for this product.
Tanium Health Check Affected: 1.13 , < 1.13.653 (custom)
Create a notification for this product.
Tanium Endpoint Configuration Toolset Solution Affected: 1.51 , < 1.51.61 (custom)
Affected: 1.59 , < 1.59.51 (custom)
Affected: 1.71 , < 1.71.26 (custom)
Create a notification for this product.
Tanium Patch Affected: 3.24 , < 3.24.328 (custom)
Affected: 3.28 , < 3.28.346 (custom)
Affected: 3.32 , < 3.32.383 (custom)
Create a notification for this product.
Tanium Performance Affected: 1.25 , < 1.25.196 (custom)
Create a notification for this product.
Tanium Reputation Affected: 6.6 , < 6.6.150 (custom)
Affected: 6.7 , < 6.7.143 (custom)
Affected: 6.8 , < 6.8.167 (custom)
Create a notification for this product.
Tanium Reveal Affected: 2.4 , < 2.4.109 (custom)
Affected: 2.5 , < 2.5.166 (custom)
Create a notification for this product.
Tanium Threat Response Affected: 4.9 , < 4.9.480 (custom)
Affected: 4.12 , < 4.12.353 (custom)
Affected: 4.17 , < 4.17.333 (custom)
Create a notification for this product.
Tanium Provision Host Affected: 10.4.100 , < 10.4.100 (semver)
Affected: 10.8.115 , < 10.8.115 (semver)
Affected: 10.9.113 , < 10.9.113 (semver)
Affected: 10.10.189 , < 10.10.189 (semver)
Affected: 10.11.127 , < 10.11.127 (semver)
Create a notification for this product.
Date Public
2026-11-03 22:12
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121565",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T19:26:46.759376Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T19:26:57.322Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "TanOS",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "1.8.5.0326",
              "status": "affected",
              "version": "1.8.5",
              "versionType": "custom"
            },
            {
              "lessThan": "1.8.6.0193",
              "status": "affected",
              "version": "1.8.6",
              "versionType": "custom"
            },
            {
              "lessThan": "1.9.0.0089",
              "status": "affected",
              "version": "1.9.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Asset",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "1.33.334",
              "status": "affected",
              "version": "1.33",
              "versionType": "custom"
            },
            {
              "lessThan": "1.36.182",
              "status": "affected",
              "version": "1.36",
              "versionType": "custom"
            },
            {
              "lessThan": "1.39.164",
              "status": "affected",
              "version": "1.39",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Comply",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "2.32.275",
              "status": "affected",
              "version": "2.32",
              "versionType": "custom"
            },
            {
              "lessThan": "2.35.337",
              "status": "affected",
              "version": "2.35",
              "versionType": "custom"
            },
            {
              "lessThan": "2.37.347",
              "status": "affected",
              "version": "2.37",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Connect",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "5.29.272",
              "status": "affected",
              "version": "5.29",
              "versionType": "custom"
            },
            {
              "lessThan": "5.37.177",
              "status": "affected",
              "version": "5.37",
              "versionType": "custom"
            },
            {
              "lessThan": "5.47.135",
              "status": "affected",
              "version": "5.47",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Integrity Monitor",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "3.6.608",
              "status": "affected",
              "version": "3.6",
              "versionType": "custom"
            },
            {
              "lessThan": "3.7.383",
              "status": "affected",
              "version": "3.7",
              "versionType": "custom"
            },
            {
              "lessThan": "3.8.362",
              "status": "affected",
              "version": "3.8",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Health Check",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "1.13.653",
              "status": "affected",
              "version": "1.13",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Endpoint Configuration Toolset Solution",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "1.51.61",
              "status": "affected",
              "version": "1.51",
              "versionType": "custom"
            },
            {
              "lessThan": "1.59.51",
              "status": "affected",
              "version": "1.59",
              "versionType": "custom"
            },
            {
              "lessThan": "1.71.26",
              "status": "affected",
              "version": "1.71",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Patch",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "3.24.328",
              "status": "affected",
              "version": "3.24",
              "versionType": "custom"
            },
            {
              "lessThan": "3.28.346",
              "status": "affected",
              "version": "3.28",
              "versionType": "custom"
            },
            {
              "lessThan": "3.32.383",
              "status": "affected",
              "version": "3.32",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Performance",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "1.25.196",
              "status": "affected",
              "version": "1.25",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Reputation",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "6.6.150",
              "status": "affected",
              "version": "6.6",
              "versionType": "custom"
            },
            {
              "lessThan": "6.7.143",
              "status": "affected",
              "version": "6.7",
              "versionType": "custom"
            },
            {
              "lessThan": "6.8.167",
              "status": "affected",
              "version": "6.8",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Reveal",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "2.4.109",
              "status": "affected",
              "version": "2.4",
              "versionType": "custom"
            },
            {
              "lessThan": "2.5.166",
              "status": "affected",
              "version": "2.5",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Threat Response",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "4.9.480",
              "status": "affected",
              "version": "4.9",
              "versionType": "custom"
            },
            {
              "lessThan": "4.12.353",
              "status": "affected",
              "version": "4.12",
              "versionType": "custom"
            },
            {
              "lessThan": "4.17.333",
              "status": "affected",
              "version": "4.17",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Provision Host",
          "vendor": "Tanium",
          "versions": [
            {
              "lessThan": "10.4.100",
              "status": "affected",
              "version": "10.4.100",
              "versionType": "semver"
            },
            {
              "lessThan": "10.8.115",
              "status": "affected",
              "version": "10.8.115",
              "versionType": "semver"
            },
            {
              "lessThan": "10.9.113",
              "status": "affected",
              "version": "10.9.113",
              "versionType": "semver"
            },
            {
              "lessThan": "10.10.189",
              "status": "affected",
              "version": "10.10.189",
              "versionType": "semver"
            },
            {
              "lessThan": "10.11.127",
              "status": "affected",
              "version": "10.11.127",
              "versionType": "semver"
            }
          ]
        }
      ],
      "dateAssigned": "2026-11-03T14:58:46.819Z",
      "datePublic": "2026-11-03T22:12:11.458Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T11:24:05.622Z",
        "orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
        "shortName": "Tanium"
      },
      "references": [
        {
          "name": "TAN-2026-092",
          "url": "https://security.tanium.com/TAN-2026-092"
        }
      ],
      "title": "Tanium addressed an improper certificate validation vulnerability in multiple products"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
    "assignerShortName": "Tanium",
    "cveId": "CVE-2026-121565",
    "datePublished": "2026-11-03T22:17:22.997Z",
    "dateReserved": "2026-11-03T14:58:47.328Z",
    "dateUpdated": "2026-11-06T19:26:57.322Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121452 (GCVE-0-2026-121452)

Vulnerability from cvelistv5 – Published: 2026-11-03 15:17 – Updated: 2026-11-03 18:28
VLAI
Title
bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service
Summary
bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.
Severity
8.3 (High)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:21 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7605 records in the last 180 days details
References
Impacted products
Vendor Product Version
mlogclub bbs-go Affected: 0 , ≤ 4.4.6 (semver)
    cpe:2.3:a:bbs-go_project:bbs-go:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-26 00:00
Credits
George Chen
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121452",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T17:21:23.781193Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T18:28:15.865Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/bbs-go",
          "product": "bbs-go",
          "vendor": "mlogclub",
          "versions": [
            {
              "lessThanOrEqual": "4.4.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:bbs-go_project:bbs-go:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "4.4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-10-26T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T15:17:01.813Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #310",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/mlogclub/bbs-go/issues/310"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/mlogclub/bbs-go"
        },
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/mlogclub/bbs-go/commit/1a06e35fa6314ee2d3ada70685a7afa740baf6f5"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/services/email_service.go#L86-L113"
        },
        {
          "name": "VulnCheck Advisory: bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-improper-tls-certificate-validation-in-smtp-email-service"
        }
      ],
      "title": "bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-121452",
    "datePublished": "2026-11-03T15:17:01.813Z",
    "dateReserved": "2026-11-03T12:33:53.717Z",
    "dateUpdated": "2026-11-03T18:28:15.865Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121392 (GCVE-0-2026-121392)

Vulnerability from cvelistv5 – Published: 2026-11-03 14:27 – Updated: 2026-11-03 18:31
VLAI
Title
FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate
Summary
FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.
Severity
9.1 (Critical)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:48 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7605 records in the last 180 days details
References
Impacted products
Vendor Product Version
FreeRDP FreeRDP Affected: 0 , < 3.32.2 (semver)
Unaffected: 3.32.2 (semver)
    cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-19 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121392",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T17:48:51.108013Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T18:31:19.966Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "FreeRDP",
          "vendor": "FreeRDP",
          "versions": [
            {
              "lessThan": "3.32.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.32.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.32.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2026-10-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T14:27:57.885Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-jq25-3374-4262)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jq25-3374-4262"
        },
        {
          "name": "VulnCheck Advisory: FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-certificate-identity-validation-bypass-via-tls-verify-certificate"
        }
      ],
      "title": "FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-121392",
    "datePublished": "2026-11-03T14:27:57.885Z",
    "dateReserved": "2026-11-03T12:26:31.384Z",
    "dateUpdated": "2026-11-03T18:31:19.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-121147 (GCVE-0-2026-121147)

Vulnerability from cvelistv5 – Published: 2026-11-04 12:43 – Updated: 2026-11-05 19:07
VLAI
Title
Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application
Summary
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services.
Severity
8.5 (High)
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 20:41 UTC
CWE
  • CWE-295 - Improper certificate validation
Assigner
CERT-In CNA under the mitre root
CNA scorecard B 90/100 over 23 records in the last 180 days details
References
Impacted products
Vendor Product Version
Tata Motors Tata Motors iRA 2.0 Affected: versions 26.7.3 and below
    cpe:2.3:a:tata_motors:tata_motors_ira_2.0:versions_26.7.3_and_below:*:*:*:*:*:*:*
Create a notification for this product.
Tata Motors Tata Motors iRA.ev Affected: versions 26.7.2 and below
    cpe:2.3:a:tata_motors:tata_motors_ira.ev:versions_26.7.2_and_below:*:*:*:*:*:*:*
Create a notification for this product.
Credits
This vulnerability is reported by Pranav Rajendran.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121147",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T20:41:44.554987Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:07:49.340Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Tata Motors iRA 2.0",
          "vendor": "Tata Motors",
          "versions": [
            {
              "status": "affected",
              "version": "versions 26.7.3 and below"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Tata Motors iRA.ev",
          "vendor": "Tata Motors",
          "versions": [
            {
              "status": "affected",
              "version": "versions 26.7.2 and below"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:tata_motors:tata_motors_ira_2.0:versions_26.7.3_and_below:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:tata_motors:tata_motors_ira.ev:versions_26.7.2_and_below:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability is reported by Pranav Rajendran."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services."
            }
          ],
          "value": "This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94 Adversary in the Middle (AiTM)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295 Improper certificate validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T12:43:17.895Z",
        "orgId": "66834db9-ab24-42b4-be80-296b2e40335c",
        "shortName": "CERT-In"
      },
      "references": [
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2026-0537"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Upgrade to latest versions:\n\u003cbr\u003eTata Motors iRA 2.0 to version 26.8.2 \n\u003cbr\u003eTata Motors iRA.ev to version 26.9.1\u0026nbsp;\u003cbr\u003e"
            }
          ],
          "value": "Upgrade to latest versions:\n\nTata Motors iRA 2.0 to version 26.8.2 \n\nTata Motors iRA.ev to version 26.9.1"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application",
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "66834db9-ab24-42b4-be80-296b2e40335c",
    "assignerShortName": "CERT-In",
    "cveId": "CVE-2026-121147",
    "datePublished": "2026-11-04T12:43:17.895Z",
    "dateReserved": "2026-11-03T10:01:29.370Z",
    "dateUpdated": "2026-11-05T19:07:49.340Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-120250 (GCVE-0-2026-120250)

Vulnerability from cvelistv5 – Published: 2026-11-01 00:57 – Updated: 2026-11-05 15:39
VLAI
Title
OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections
Summary
OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a forged certificate to intercept SMTP credentials and all later mail, including password-reset links.
Severity
6 (Medium)
CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
5.3 (Medium)
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 15:39 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7605 records in the last 180 days details
References
Impacted products
Vendor Product Version
marketcalls OpenAlgo Affected: 1.0.0.29 , < 2.0.3.1 (custom)
Create a notification for this product.
Date Public
2026-10-29 00:00
Credits
Tommaso Bona (ParzivalHack) marketcalls
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-120250",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T15:39:05.887315Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T15:39:19.445Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/marketcalls/openalgo",
          "product": "OpenAlgo",
          "repo": "https://github.com/marketcalls/openalgo",
          "vendor": "marketcalls",
          "versions": [
            {
              "lessThan": "2.0.3.1",
              "status": "affected",
              "version": "1.0.0.29",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Tommaso Bona (ParzivalHack)"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "marketcalls"
        }
      ],
      "datePublic": "2026-10-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a forged certificate to intercept SMTP credentials and all later mail, including password-reset links."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-01T00:57:14.226Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/marketcalls/openalgo/commit/af5d5f2cc564ee31cdd1159bc147a9b03cc713ac"
        },
        {
          "name": "OpenAlgo 2.0.3.1 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/marketcalls/openalgo/blob/main/docs/releases/version-2.0.3.1-released.md"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/marketcalls/openalgo/blob/96e5927e5adbff146f203bf72c7a79add9e6622c/utils/email_utils.py#L403-L406"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/marketcalls/openalgo"
        },
        {
          "name": "VulnCheck Advisory: OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openalgo-1.0.0.29-before-2.0.3.1-improper-certificate-validation-in-smtp-connections"
        }
      ],
      "title": "OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-120250",
    "datePublished": "2026-11-01T00:57:14.226Z",
    "dateReserved": "2026-10-31T22:06:00.139Z",
    "dateUpdated": "2026-11-05T15:39:19.445Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119559 (GCVE-0-2026-119559)

Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-11-05 21:45
VLAI
Title
OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch
Summary
OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host's SNI with a protected Host header to access protected content.
Severity
8.2 (High)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:42 UTC
CWE
  • CWE-295 - Improper Certificate Validation
Assigner
VulnCheck CNA under the mitre root
CNA scorecard B 84/100 over 7605 records in the last 180 days details
References
Impacted products
Vendor Product Version
litespeedtech openlitespeed Affected: 0 , ≤ 1.9.4 (semver)
    cpe:2.3:a:litespeedtech:openlitespeed:*:*:*:*:*:*:*:*
Create a notification for this product.
Date Public
2026-10-12 00:00
Credits
Abraxas Labs
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119559",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-05T21:42:53.138822Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T21:45:08.355Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://abraxaslabs.tech/research/openlitespeed-h3-mtls-verifycontext"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/litespeedtech/openlitespeed",
          "product": "openlitespeed",
          "repo": "https://github.com/litespeedtech/openlitespeed",
          "vendor": "litespeedtech",
          "versions": [
            {
              "lessThanOrEqual": "1.9.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:litespeedtech:openlitespeed:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "1.9.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Abraxas Labs"
        }
      ],
      "datePublic": "2026-10-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host\u0027s SNI with a protected Host header to access protected content."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-30T11:31:08.276Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/litespeedtech/openlitespeed/blob/v1.9.4/src/http/httpsession.cpp#L1665-L1672"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/litespeedtech/openlitespeed/blob/v1.9.4/src/sslpp/hiocrypto.h#L49-L50"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/litespeedtech/openlitespeed/blob/v1.9.4/src/quic/quicstream.h#L33-L37"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://abraxaslabs.tech/research/openlitespeed-h3-mtls-verifycontext"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/litespeedtech/openlitespeed"
        },
        {
          "name": "VulnCheck Advisory: OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openlitespeed-through-1.9.4-mtls-bypass-via-http-3-sni-and-host-mismatch"
        }
      ],
      "title": "OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119559",
    "datePublished": "2026-10-30T11:31:08.276Z",
    "dateReserved": "2026-10-30T10:53:29.316Z",
    "dateUpdated": "2026-11-05T21:45:08.355Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-119190 (GCVE-0-2026-119190)

Vulnerability from cvelistv5 – Published: 2026-10-29 19:25 – Updated: 2026-10-29 20:25
VLAI
Title
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
Summary
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.
Severity
7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 20:24 UTC
CWE
  • CWE-295 - Improper Certificate Validation
  • CWE-436 - Interpretation Conflict
Assigner
GitHub_M CNA under the mitre root
CNA scorecard C 72/100 over 7895 records in the last 180 days details
References
Impacted products
Vendor Product Version
digitalbazaar forge Affected: < 1.4.1
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119190",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-29T20:24:38.825329Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-29T20:25:04.131Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "forge",
          "vendor": "digitalbazaar",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "CWE-295: Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436: Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-29T19:25:09.677Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p"
        },
        {
          "name": "https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a"
        },
        {
          "name": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"
        }
      ],
      "source": {
        "advisory": "GHSA-5x38-2vff-x55p",
        "discovery": "UNKNOWN"
      },
      "title": "Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-119190",
    "datePublished": "2026-10-29T19:25:09.677Z",
    "dateReserved": "2026-10-29T16:04:48.728Z",
    "dateUpdated": "2026-10-29T20:25:04.131Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}
Mitigation
Architecture and Design Implementation

Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.

Mitigation
Implementation

If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

CAPEC-459: Creating a Rogue Certification Authority Certificate

An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.

CAPEC-475: Signature Spoofing by Improper Validation

An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.

← Back to the CWE list