wolfSSH fails to validate that the ECDSA curve identifier in a KEXDH REPLY host key blob matches the algorithm negotiated during key exchange. In the `ParseECCPubKey()` function, the blob's algorithm string is used to derive the curve via `NameToId`/`wcPrimeForId` without verifying it against the negotiated `ssh->handshake->pubKeyId`. Additionally, the RFC 5656 curve identifier string is discarded via `GetSkip()` instead of being compared. A man-in-the-middle attacker can substitute a host key blob with a different ECDSA curve, leading the client to import the key on the wrong curve. Since the attacker controls the private key for the substituted curve, signature verification succeeds. This requires an active man-in-the-middle position and a lax public key check callback, such as Trust On First Use (TOFU), algorithm-name-only checks, or fingerprint matches against the parsed key.