CVE-2026-78135

libcharon in strongSwan (versions 5.9.7 through 6.0.7) mishandles CREATE_CHILD_SA requests on unestablished IKE SAs within the IKEv2 state machine, allowing the creation of a usable Child SA before authentication completes (authentication bypass). The vulnerability requires no privileges but has ...