1083 matches found
PT-2026-82635
libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the CURLOPT SSLCERT option --cert with the command line tool.When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certifica...
PT-2026-73407
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS mTLS client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
CVE-2026-18703
An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow...
UBUNTU-CVE-2026-18703
An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow...
CVE-2026-66760
SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute...
CVE-2026-66760
Technical details about CVE-2026-66760 are not publicly available in the provided documents beyond what is described in the Initial Description; monitor for updates.
EUVD-2026-55878
SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with matching subject values, could bypass the identity check. This complexity makes the attack difficult to execute...
JLSEC-2026-1217 libcurl would reuse a previously created connection even when some mTLS config related option had...
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS...
CVE-2026-67294
A flaw was found in FreeRDP. During client-side server Transport Layer Security TLS authentication, FreeRDP improperly validates the Extended Key Usage EKU purpose of the peer certificate. This vulnerability allows a certificate intended only for client authentication to be accepted as a server...
UBUNTU-CVE-2026-67294
FreeRDP before 3.29.0 improperly validates the Extended Key Usage EKU purpose of the peer certificate during client-side server TLS authentication. In x509utilsverify, when server-purpose X509PURPOSESSLSERVER verification fails, the code falls back to client-purpose and any-purpose verification, ...
PT-2026-67274
Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.29.0 Description Improper validation of the Extended Key Usage EKU purpose occurs during client-side server TLS authentication. Within the x509 utils verify function, if the server-purpose X509 PURPOSE SSL SERVER...
SUSE CVE-2026-6720
When calicoctl is invoked with --log-level=info or --log-level=debug, the client prints the full contents of its loaded connection-configuration struct to stderr in a single log line. The struct embeds every credential calicoctl uses to talk to the cluster - inline kubeconfig with bearer token,...
SUSE CVE-2026-7776
Boundary Community Edition and Boundary Enterprise “Boundary” workers are vulnerable to a denial-of-service condition during node enrollment TLS handshakes. An attacker with network access to the worker authentication listener may open a connection and delay or withhold the client certificate...
EUVD-2026-47794
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...
CVE-2026-13067 tlsCATrusts Role Restriction Not Enforced via PROXY Protocol v2 on Unix Domain Socket
When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...
JLSEC-2026-737 TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished...
TLS 1.3 post-handshake authentication PHA issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent peer certificate was only intended for the initial handshake, b...
BIT-ETCD-2026-59818 etcd: gRPC client listener does not enforce `--client-crl-file` certificate revocation
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the...
PT-2026-58904
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.5.32 and 3.6.13, when etcd is configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the...
