CVE-2026-93302

Name of the Vulnerable Software and Affected Versions wolfSSL (affected versions not specified)

Description The MatchTrustedPeer function ignores the public key used, which allows forged CA clones to pass verification. This issue occurs in builds where the WOLFSSL TRUST PEER CERT macro is enabled and CA certificates are loaded using the wolfSSL CTX trust peer cert() or wolfSSL trust peer cert() functions. If the OPENSSL COMPATIBLE DEFAULTS macro is also defined, the issue extends to all CA certificate loading. This configuration is common in autoconf builds used by software such as nginx, haproxy, stunnel, wpas, apache httpd, hitch, bind, rsyslog, and ffmpeg. A malicious (D)TLS server can bypass authentication if it knows which CAs the client accepts, and the issue similarly affects mutual authentication scenarios where the client knows the CAs loaded by the server.

Recommendations Update to the latest wolfSSL version. Apply the fix patch. Use the configure flag --disable-openssl-compatible-defaults and avoid loading CAs with wolfSSL CTX trust peer cert() or wolfSSL trust peer cert().