CVE-2026-129092

The CCC Attestation SIG attested-tls-poc (through commit 731ca82) contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability. The root cause is that Evidence is appraised only once during the TLS handshake without post-handshake re-attestation. This allows an attacker with local access to the at...