Common Weakness Enumeration
CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
2437 vulnerabilities reference this CWE, most recent first.
CVE-2026-121638 (GCVE-0-2026-121638)
Vulnerability from cvelistv5 – Published: 2026-11-04 14:44 – Updated: 2026-11-04 14:44
VLAI
EPSS
VEX
Title
WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks
Summary
An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers.
Severity
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://psirt.watchguard.com/CVE-2026-121638 | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| WatchGuard | AuthPoint Authentication Gateway |
Affected:
1.0 , < 7.6.0
(semver)
cpe:2.3:a:watchguard:authpoint_authentication_gateway:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AuthPoint Authentication Gateway",
"vendor": "WatchGuard",
"versions": [
{
"lessThan": "7.6.0",
"status": "affected",
"version": "1.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThis vulnerability affects AuthPoint Gateway deployments configured with a RADIUS, LDAP or ADFS resource.\u003c/p\u003e"
}
],
"value": "This vulnerability affects AuthPoint Gateway deployments configured with a RADIUS, LDAP or ADFS resource."
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:watchguard:authpoint_authentication_gateway:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.6.0",
"versionStartIncluding": "1.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "WatchGuard AI Security Research"
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to intercept and modify communications between the AuthPoint Gateway and local authentication providers."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."
}
],
"value": "WatchGuard is not aware of any exploitation of this vulnerability in the wild."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T14:44:14.541Z",
"orgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"shortName": "WatchGuard"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://psirt.watchguard.com/CVE-2026-121638"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "AuthPoint Authentication Gateway 7.6.0"
}
],
"value": "AuthPoint Authentication Gateway 7.6.0"
}
],
"title": "WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks"
}
},
"cveMetadata": {
"assignerOrgId": "5d1c2695-1a31-4499-88ae-e847036fd7e3",
"assignerShortName": "WatchGuard",
"cveId": "CVE-2026-121638",
"datePublished": "2026-11-04T14:44:14.541Z",
"dateReserved": "2026-11-03T17:27:06.115Z",
"dateUpdated": "2026-11-04T14:44:14.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121624 (GCVE-0-2026-121624)
Vulnerability from cvelistv5 – Published: 2026-11-03 17:13 – Updated: 2026-11-03 22:41
VLAI
EPSS
VEX
Title
Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation
Summary
Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 22:36 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve | technical-description |
| https://www.supremocontrol.com/changelog/ | release-notes |
| https://www.supremocontrol.com/ | product |
| https://www.vulncheck.com/advisories/nanosystems-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nanosystems | Supremo |
Affected:
0 , < 5.0.2.3874
(custom)
|
Date Public
2026-11-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121624",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T22:36:34.514075Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:41:14.021Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Supremo",
"vendor": "Nanosystems",
"versions": [
{
"lessThan": "5.0.2.3874",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Pusineri"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client\u0027s TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:13:52.053Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve"
},
{
"tags": [
"release-notes"
],
"url": "https://www.supremocontrol.com/changelog/"
},
{
"tags": [
"product"
],
"url": "https://www.supremocontrol.com/"
},
{
"name": "VulnCheck Advisory: Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nanosystems-supremo-before-5.0.2.3874-improper-tls-certificate-validation"
}
],
"title": "Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121624",
"datePublished": "2026-11-03T17:13:52.053Z",
"dateReserved": "2026-11-03T16:57:36.800Z",
"dateUpdated": "2026-11-03T22:41:14.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121565 (GCVE-0-2026-121565)
Vulnerability from cvelistv5 – Published: 2026-11-03 22:17 – Updated: 2026-11-04 11:24
VLAI
EPSS
VEX
Title
Tanium addressed an improper certificate validation vulnerability in multiple products
Summary
Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.
Severity
7.4 (High)
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
Impacted products
13 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | TanOS |
Affected:
1.8.5 , < 1.8.5.0326
(custom)
Affected: 1.8.6 , < 1.8.6.0193 (custom) Affected: 1.9.0 , < 1.9.0.0089 (custom) |
|
| Tanium | Asset |
Affected:
1.33 , < 1.33.334
(custom)
Affected: 1.36 , < 1.36.182 (custom) Affected: 1.39 , < 1.39.164 (custom) |
|
| Tanium | Comply |
Affected:
2.32 , < 2.32.275
(custom)
Affected: 2.35 , < 2.35.337 (custom) Affected: 2.37 , < 2.37.347 (custom) |
|
| Tanium | Connect |
Affected:
5.29 , < 5.29.272
(custom)
Affected: 5.37 , < 5.37.177 (custom) Affected: 5.47 , < 5.47.135 (custom) |
|
| Tanium | Integrity Monitor |
Affected:
3.6 , < 3.6.608
(custom)
Affected: 3.7 , < 3.7.383 (custom) Affected: 3.8 , < 3.8.362 (custom) |
|
| Tanium | Health Check |
Affected:
1.13 , < 1.13.653
(custom)
|
|
| Tanium | Endpoint Configuration Toolset Solution |
Affected:
1.51 , < 1.51.61
(custom)
Affected: 1.59 , < 1.59.51 (custom) Affected: 1.71 , < 1.71.26 (custom) |
|
| Tanium | Patch |
Affected:
3.24 , < 3.24.328
(custom)
Affected: 3.28 , < 3.28.346 (custom) Affected: 3.32 , < 3.32.383 (custom) |
|
| Tanium | Performance |
Affected:
1.25 , < 1.25.196
(custom)
|
|
| Tanium | Reputation |
Affected:
6.6 , < 6.6.150
(custom)
Affected: 6.7 , < 6.7.143 (custom) Affected: 6.8 , < 6.8.167 (custom) |
|
| Tanium | Reveal |
Affected:
2.4 , < 2.4.109
(custom)
Affected: 2.5 , < 2.5.166 (custom) |
|
| Tanium | Threat Response |
Affected:
4.9 , < 4.9.480
(custom)
Affected: 4.12 , < 4.12.353 (custom) Affected: 4.17 , < 4.17.333 (custom) |
|
| Tanium | Provision Host |
Affected:
10.4.100 , < 10.4.100
(semver)
Affected: 10.8.115 , < 10.8.115 (semver) Affected: 10.9.113 , < 10.9.113 (semver) Affected: 10.10.189 , < 10.10.189 (semver) Affected: 10.11.127 , < 10.11.127 (semver) |
Date Public
2026-11-03 22:12
{
"containers": {
"cna": {
"affected": [
{
"product": "TanOS",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.8.5.0326",
"status": "affected",
"version": "1.8.5",
"versionType": "custom"
},
{
"lessThan": "1.8.6.0193",
"status": "affected",
"version": "1.8.6",
"versionType": "custom"
},
{
"lessThan": "1.9.0.0089",
"status": "affected",
"version": "1.9.0",
"versionType": "custom"
}
]
},
{
"product": "Asset",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.33.334",
"status": "affected",
"version": "1.33",
"versionType": "custom"
},
{
"lessThan": "1.36.182",
"status": "affected",
"version": "1.36",
"versionType": "custom"
},
{
"lessThan": "1.39.164",
"status": "affected",
"version": "1.39",
"versionType": "custom"
}
]
},
{
"product": "Comply",
"vendor": "Tanium",
"versions": [
{
"lessThan": "2.32.275",
"status": "affected",
"version": "2.32",
"versionType": "custom"
},
{
"lessThan": "2.35.337",
"status": "affected",
"version": "2.35",
"versionType": "custom"
},
{
"lessThan": "2.37.347",
"status": "affected",
"version": "2.37",
"versionType": "custom"
}
]
},
{
"product": "Connect",
"vendor": "Tanium",
"versions": [
{
"lessThan": "5.29.272",
"status": "affected",
"version": "5.29",
"versionType": "custom"
},
{
"lessThan": "5.37.177",
"status": "affected",
"version": "5.37",
"versionType": "custom"
},
{
"lessThan": "5.47.135",
"status": "affected",
"version": "5.47",
"versionType": "custom"
}
]
},
{
"product": "Integrity Monitor",
"vendor": "Tanium",
"versions": [
{
"lessThan": "3.6.608",
"status": "affected",
"version": "3.6",
"versionType": "custom"
},
{
"lessThan": "3.7.383",
"status": "affected",
"version": "3.7",
"versionType": "custom"
},
{
"lessThan": "3.8.362",
"status": "affected",
"version": "3.8",
"versionType": "custom"
}
]
},
{
"product": "Health Check",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.13.653",
"status": "affected",
"version": "1.13",
"versionType": "custom"
}
]
},
{
"product": "Endpoint Configuration Toolset Solution",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.51.61",
"status": "affected",
"version": "1.51",
"versionType": "custom"
},
{
"lessThan": "1.59.51",
"status": "affected",
"version": "1.59",
"versionType": "custom"
},
{
"lessThan": "1.71.26",
"status": "affected",
"version": "1.71",
"versionType": "custom"
}
]
},
{
"product": "Patch",
"vendor": "Tanium",
"versions": [
{
"lessThan": "3.24.328",
"status": "affected",
"version": "3.24",
"versionType": "custom"
},
{
"lessThan": "3.28.346",
"status": "affected",
"version": "3.28",
"versionType": "custom"
},
{
"lessThan": "3.32.383",
"status": "affected",
"version": "3.32",
"versionType": "custom"
}
]
},
{
"product": "Performance",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.25.196",
"status": "affected",
"version": "1.25",
"versionType": "custom"
}
]
},
{
"product": "Reputation",
"vendor": "Tanium",
"versions": [
{
"lessThan": "6.6.150",
"status": "affected",
"version": "6.6",
"versionType": "custom"
},
{
"lessThan": "6.7.143",
"status": "affected",
"version": "6.7",
"versionType": "custom"
},
{
"lessThan": "6.8.167",
"status": "affected",
"version": "6.8",
"versionType": "custom"
}
]
},
{
"product": "Reveal",
"vendor": "Tanium",
"versions": [
{
"lessThan": "2.4.109",
"status": "affected",
"version": "2.4",
"versionType": "custom"
},
{
"lessThan": "2.5.166",
"status": "affected",
"version": "2.5",
"versionType": "custom"
}
]
},
{
"product": "Threat Response",
"vendor": "Tanium",
"versions": [
{
"lessThan": "4.9.480",
"status": "affected",
"version": "4.9",
"versionType": "custom"
},
{
"lessThan": "4.12.353",
"status": "affected",
"version": "4.12",
"versionType": "custom"
},
{
"lessThan": "4.17.333",
"status": "affected",
"version": "4.17",
"versionType": "custom"
}
]
},
{
"product": "Provision Host",
"vendor": "Tanium",
"versions": [
{
"lessThan": "10.4.100",
"status": "affected",
"version": "10.4.100",
"versionType": "semver"
},
{
"lessThan": "10.8.115",
"status": "affected",
"version": "10.8.115",
"versionType": "semver"
},
{
"lessThan": "10.9.113",
"status": "affected",
"version": "10.9.113",
"versionType": "semver"
},
{
"lessThan": "10.10.189",
"status": "affected",
"version": "10.10.189",
"versionType": "semver"
},
{
"lessThan": "10.11.127",
"status": "affected",
"version": "10.11.127",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2026-11-03T14:58:46.819Z",
"datePublic": "2026-11-03T22:12:11.458Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T11:24:05.622Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-092",
"url": "https://security.tanium.com/TAN-2026-092"
}
],
"title": "Tanium addressed an improper certificate validation vulnerability in multiple products"
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-121565",
"datePublished": "2026-11-03T22:17:22.997Z",
"dateReserved": "2026-11-03T14:58:47.328Z",
"dateUpdated": "2026-11-04T11:24:05.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121452 (GCVE-0-2026-121452)
Vulnerability from cvelistv5 – Published: 2026-11-03 15:17 – Updated: 2026-11-03 18:28
VLAI
EPSS
VEX
Title
bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service
Summary
bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:21 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/mlogclub/bbs-go/issues/310 | issue-tracking |
| https://github.com/mlogclub/bbs-go | product |
| https://github.com/mlogclub/bbs-go/commit/1a06e35… | patch |
| https://github.com/mlogclub/bbs-go/blob/v4.4.6/in… | technical-description |
| https://www.vulncheck.com/advisories/bbs-go-throu… | third-party-advisory |
Impacted products
Date Public
2026-10-26 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T17:21:23.781193Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:28:15.865Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/bbs-go",
"product": "bbs-go",
"vendor": "mlogclub",
"versions": [
{
"lessThanOrEqual": "4.4.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:bbs-go_project:bbs-go:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-10-26T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T15:17:01.813Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #310",
"tags": [
"issue-tracking"
],
"url": "https://github.com/mlogclub/bbs-go/issues/310"
},
{
"tags": [
"product"
],
"url": "https://github.com/mlogclub/bbs-go"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/mlogclub/bbs-go/commit/1a06e35fa6314ee2d3ada70685a7afa740baf6f5"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/mlogclub/bbs-go/blob/v4.4.6/internal/services/email_service.go#L86-L113"
},
{
"name": "VulnCheck Advisory: bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/bbs-go-through-4.4.6-improper-tls-certificate-validation-in-smtp-email-service"
}
],
"title": "bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121452",
"datePublished": "2026-11-03T15:17:01.813Z",
"dateReserved": "2026-11-03T12:33:53.717Z",
"dateUpdated": "2026-11-03T18:28:15.865Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121392 (GCVE-0-2026-121392)
Vulnerability from cvelistv5 – Published: 2026-11-03 14:27 – Updated: 2026-11-03 18:31
VLAI
EPSS
VEX
Title
FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate
Summary
FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 17:48 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-befo… | third-party-advisory |
Impacted products
Date Public
2026-10-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121392",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T17:48:51.108013Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T18:31:19.966Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.2",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.2",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T14:27:57.885Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-jq25-3374-4262)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-jq25-3374-4262"
},
{
"name": "VulnCheck Advisory: FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-before-3.32.2-certificate-identity-validation-bypass-via-tls-verify-certificate"
}
],
"title": "FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121392",
"datePublished": "2026-11-03T14:27:57.885Z",
"dateReserved": "2026-11-03T12:26:31.384Z",
"dateUpdated": "2026-11-03T18:31:19.966Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121147 (GCVE-0-2026-121147)
Vulnerability from cvelistv5 – Published: 2026-11-04 12:43 – Updated: 2026-11-04 12:43
VLAI
EPSS
VEX
Title
Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application
Summary
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services.
Severity
CWE
- CWE-295 - Improper certificate validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.cert-in.org.in/s2cMainServlet?pageid=… | third-party-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tata Motors | Tata Motors iRA 2.0 |
Affected:
versions 26.7.3 and below
cpe:2.3:a:tata_motors:tata_motors_ira_2.0:versions_26.7.3_and_below:*:*:*:*:*:*:* |
|
| Tata Motors | Tata Motors iRA.ev |
Affected:
versions 26.7.2 and below
cpe:2.3:a:tata_motors:tata_motors_ira.ev:versions_26.7.2_and_below:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Tata Motors iRA 2.0",
"vendor": "Tata Motors",
"versions": [
{
"status": "affected",
"version": "versions 26.7.3 and below"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Tata Motors iRA.ev",
"vendor": "Tata Motors",
"versions": [
{
"status": "affected",
"version": "versions 26.7.2 and below"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tata_motors:tata_motors_ira_2.0:versions_26.7.3_and_below:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:tata_motors:tata_motors_ira.ev:versions_26.7.2_and_below:*:*:*:*:*:*:*",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This vulnerability is reported by Pranav Rajendran."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services."
}
],
"value": "This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-94 Adversary in the Middle (AiTM)"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper certificate validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T12:43:17.895Z",
"orgId": "66834db9-ab24-42b4-be80-296b2e40335c",
"shortName": "CERT-In"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01\u0026VLCODE=CIVN-2026-0537"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to latest versions:\n\u003cbr\u003eTata Motors iRA 2.0 to version 26.8.2 \n\u003cbr\u003eTata Motors iRA.ev to version 26.9.1\u0026nbsp;\u003cbr\u003e"
}
],
"value": "Upgrade to latest versions:\n\nTata Motors iRA 2.0 to version 26.8.2 \n\nTata Motors iRA.ev to version 26.9.1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "66834db9-ab24-42b4-be80-296b2e40335c",
"assignerShortName": "CERT-In",
"cveId": "CVE-2026-121147",
"datePublished": "2026-11-04T12:43:17.895Z",
"dateReserved": "2026-11-03T10:01:29.370Z",
"dateUpdated": "2026-11-04T12:43:17.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120250 (GCVE-0-2026-120250)
Vulnerability from cvelistv5 – Published: 2026-11-01 00:57 – Updated: 2026-11-01 00:57
VLAI
EPSS
VEX
Title
OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections
Summary
OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a forged certificate to intercept SMTP credentials and all later mail, including password-reset links.
Severity
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/marketcalls/openalgo/commit/af… | patch |
| https://github.com/marketcalls/openalgo/blob/main… | release-notes |
| https://github.com/marketcalls/openalgo/blob/96e5… | technical-description |
| https://github.com/marketcalls/openalgo | product |
| https://www.vulncheck.com/advisories/openalgo-1.0… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| marketcalls | OpenAlgo |
Affected:
1.0.0.29 , < 2.0.3.1
(custom)
|
Date Public
2026-10-29 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/marketcalls/openalgo",
"product": "OpenAlgo",
"repo": "https://github.com/marketcalls/openalgo",
"vendor": "marketcalls",
"versions": [
{
"lessThan": "2.0.3.1",
"status": "affected",
"version": "1.0.0.29",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tommaso Bona (ParzivalHack)"
},
{
"lang": "en",
"type": "remediation developer",
"value": "marketcalls"
}
],
"datePublic": "2026-10-29T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a forged certificate to intercept SMTP credentials and all later mail, including password-reset links."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-01T00:57:14.226Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/marketcalls/openalgo/commit/af5d5f2cc564ee31cdd1159bc147a9b03cc713ac"
},
{
"name": "OpenAlgo 2.0.3.1 Release Notes",
"tags": [
"release-notes"
],
"url": "https://github.com/marketcalls/openalgo/blob/main/docs/releases/version-2.0.3.1-released.md"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/marketcalls/openalgo/blob/96e5927e5adbff146f203bf72c7a79add9e6622c/utils/email_utils.py#L403-L406"
},
{
"tags": [
"product"
],
"url": "https://github.com/marketcalls/openalgo"
},
{
"name": "VulnCheck Advisory: OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openalgo-1.0.0.29-before-2.0.3.1-improper-certificate-validation-in-smtp-connections"
}
],
"title": "OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-120250",
"datePublished": "2026-11-01T00:57:14.226Z",
"dateReserved": "2026-10-31T22:06:00.139Z",
"dateUpdated": "2026-11-01T00:57:14.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119559 (GCVE-0-2026-119559)
Vulnerability from cvelistv5 – Published: 2026-10-30 11:31 – Updated: 2026-10-30 11:31
VLAI
EPSS
VEX
Title
OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch
Summary
OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host's SNI with a protected Host header to access protected content.
Severity
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/litespeedtech/openlitespeed/bl… | technical-description |
| https://github.com/litespeedtech/openlitespeed/bl… | technical-description |
| https://github.com/litespeedtech/openlitespeed/bl… | technical-description |
| https://abraxaslabs.tech/research/openlitespeed-h… | third-party-advisory |
| https://github.com/litespeedtech/openlitespeed | product |
| https://www.vulncheck.com/advisories/openlitespee… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| litespeedtech | openlitespeed |
Affected:
0 , ≤ 1.9.4
(semver)
cpe:2.3:a:litespeedtech:openlitespeed:*:*:*:*:*:*:*:* |
Date Public
2026-10-12 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/litespeedtech/openlitespeed",
"product": "openlitespeed",
"repo": "https://github.com/litespeedtech/openlitespeed",
"vendor": "litespeedtech",
"versions": [
{
"lessThanOrEqual": "1.9.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:litespeedtech:openlitespeed:*:*:*:*:*:*:*:*",
"versionEndIncluding": "1.9.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abraxas Labs"
}
],
"datePublic": "2026-10-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host\u0027s SNI with a protected Host header to access protected content."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T11:31:08.276Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://github.com/litespeedtech/openlitespeed/blob/v1.9.4/src/http/httpsession.cpp#L1665-L1672"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/litespeedtech/openlitespeed/blob/v1.9.4/src/sslpp/hiocrypto.h#L49-L50"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/litespeedtech/openlitespeed/blob/v1.9.4/src/quic/quicstream.h#L33-L37"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://abraxaslabs.tech/research/openlitespeed-h3-mtls-verifycontext"
},
{
"tags": [
"product"
],
"url": "https://github.com/litespeedtech/openlitespeed"
},
{
"name": "VulnCheck Advisory: OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/openlitespeed-through-1.9.4-mtls-bypass-via-http-3-sni-and-host-mismatch"
}
],
"title": "OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-119559",
"datePublished": "2026-10-30T11:31:08.276Z",
"dateReserved": "2026-10-30T10:53:29.316Z",
"dateUpdated": "2026-10-30T11:31:08.276Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119190 (GCVE-0-2026-119190)
Vulnerability from cvelistv5 – Published: 2026-10-29 19:25 – Updated: 2026-10-29 20:25
VLAI
EPSS
VEX
Title
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
Summary
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1.
Severity
7.4 (High)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-29 20:24 UTC
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/digitalbazaar/forge/security/a… | x_refsource_CONFIRM |
| https://github.com/digitalbazaar/forge/commit/58c… | x_refsource_MISC |
| https://github.com/digitalbazaar/forge/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| digitalbazaar | forge |
Affected:
< 1.4.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119190",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-29T20:24:38.825329Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T20:25:04.131Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "forge",
"vendor": "digitalbazaar",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge parsed deprecated extension OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and pki.verifyCertificateChain() used the first extension with that name. Exploitation requires a CA trusted by the application to issue a certificate carrying an attacker-supplied deprecated-OID extension, commonly because the CA copies extensions from a certificate signing request. By placing a permissive deprecated extension before the genuine 2.5.29.19 basicConstraints extension, the certificate holder could have the certificate accepted as a CA and issue certificates for arbitrary names, enabling server or client impersonation. If the issuing CA adds a keyUsage extension without keyCertSign, node-forge rejects the chain. This issue is fixed in version 1.4.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-436",
"description": "CWE-436: Interpretation Conflict",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T19:25:09.677Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-5x38-2vff-x55p"
},
{
"name": "https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/digitalbazaar/forge/commit/58c06bc251856b409c30ecb35a93f5f6c9bbc84a"
},
{
"name": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"
}
],
"source": {
"advisory": "GHSA-5x38-2vff-x55p",
"discovery": "UNKNOWN"
},
"title": "Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119190",
"datePublished": "2026-10-29T19:25:09.677Z",
"dateReserved": "2026-10-29T16:04:48.728Z",
"dateUpdated": "2026-10-29T20:25:04.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-119189 (GCVE-0-2026-119189)
Vulnerability from cvelistv5 – Published: 2026-10-29 19:23 – Updated: 2026-11-03 16:22
VLAI
EPSS
VEX
Title
Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
Summary
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate's basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA's private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1.
Severity
5.9 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 16:22 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/digitalbazaar/forge/security/a… | x_refsource_CONFIRM |
| https://github.com/digitalbazaar/forge/commit/696… | x_refsource_MISC |
| https://github.com/digitalbazaar/forge/releases/t… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| digitalbazaar | forge |
Affected:
< 1.4.1
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-119189",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T16:22:32.681460Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T16:22:56.742Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-h46v-rmh6-fq4f"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "forge",
"vendor": "digitalbazaar",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, node-forge enforced an X.509 CA certificate\u0027s basicConstraints.pathLenConstraint only when that certificate also carried a keyUsage extension. Exploitation requires a path-length-constrained CA without keyUsage that chains to a root trusted by the application, and an attacker who holds that CA\u0027s private key or obtains a subordinate CA certificate from it. The attacker could then construct a chain exceeding the declared path length that still passed pki.verifyCertificateChain(). Public web PKI CA certificates normally include keyUsage; private PKIs with CA certificates created without it are more likely to be affected. This issue is fixed in version 1.4.1."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-29T19:23:25.238Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-h46v-rmh6-fq4f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/digitalbazaar/forge/security/advisories/GHSA-h46v-rmh6-fq4f"
},
{
"name": "https://github.com/digitalbazaar/forge/commit/696db92348623e88cc63c35f0a89ede481d55ad0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/digitalbazaar/forge/commit/696db92348623e88cc63c35f0a89ede481d55ad0"
},
{
"name": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"
}
],
"source": {
"advisory": "GHSA-h46v-rmh6-fq4f",
"discovery": "UNKNOWN"
},
"title": "Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-119189",
"datePublished": "2026-10-29T19:23:25.238Z",
"dateReserved": "2026-10-29T16:04:48.727Z",
"dateUpdated": "2026-11-03T16:22:56.742Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.