{"cve":"CVE-2025-15346","nvd":{"published":"2026-01-08T00:15:59.393","modified":"2026-10-07T09:10:00.160","status":"Deferred","description":"A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be fully enforced. \n\nBecause the WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT flag was not included, the behavior effectively matched CERT_OPTIONAL: a peer certificate was verified if presented, but connections were incorrectly authenticated when no client certificate was provided. \n\nThis results in improper authentication, allowing attackers to bypass mutual TLS (mTLS) client authentication by omitting a client certificate during the TLS handshake. \n\nThe issue affects versions up to and including 5.8.2.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y","score":9.3},"cvss_v3":null,"cwes":["CWE-287","CWE-306"],"references":["https://github.com/wolfSSL/wolfssl-py/commit/b4517dece79f682a8f453abce5cfc0b81bae769d","https://github.com/wolfSSL/wolfssl-py/pull/62","https://github.com/wolfSSL/wolfssl-py/releases/tag/v5.8.4-stable"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:19:41.481987139+00:00"},"epss":{"cve":"CVE-2025-15346","score":0.00334,"percentile":0.26549,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-vj87-jj27-4h9c","url":"https://osv.dev/vulnerability/GHSA-vj87-jj27-4h9c","summary":"wolfSSL Python module vulnerable to Improper Authentication","modified":"2026-06-29T12:26:49.326648393Z","packages":[{"ecosystem":"PyPI","name":"wolfssl","purl":"pkg:pypi/wolfssl","ranges":["<5.8.4.post0"],"fixed":["5.8.4.post0"]}]},{"id":"PYSEC-2026-575","url":"https://osv.dev/vulnerability/PYSEC-2026-575","summary":"wolfSSL Python module vulnerable to Improper Authentication","modified":"2026-07-01T20:23:12.060789Z","packages":[{"ecosystem":"PyPI","name":"wolfssl","purl":"pkg:pypi/wolfssl","ranges":["<5.8.4.post0"],"fixed":["5.8.4.post0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}