Common Weakness Enumeration
CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
851 vulnerabilities reference this CWE, most recent first.
CVE-2026-109245 (GCVE-0-2026-109245)
Vulnerability from cvelistv5 – Published: 2026-10-12 16:04 – Updated: 2026-10-13 18:01
VLAI
EPSS
VEX
Title
FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request
Summary
FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 18:00 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
VulnCheck
CNA
References
2 references
| URL | Tags |
|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advis… | vendor-advisory |
| https://www.vulncheck.com/advisories/freerdp-3.0.… | third-party-advisory |
Impacted products
Date Public
2026-09-28 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109245",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T18:00:43.214768Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T18:01:03.073Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h44v-39x6-9xvg"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "FreeRDP",
"vendor": "FreeRDP",
"versions": [
{
"lessThan": "3.32.0",
"status": "affected",
"version": "3.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "3.32.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"versionEndExcluding": "3.32.0",
"versionStartIncluding": "3.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "DavidKorczynski"
}
],
"datePublic": "2026-09-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshakes without verifying the server certificate chain. On-path attackers can impersonate login.microsoftonline.com in the Azure AD authentication flow to capture OAuth authorization codes and substitute the OpenID discovery document."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-12T16:04:20.352Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-h44v-39x6-9xvg)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h44v-39x6-9xvg"
},
{
"name": "VulnCheck Advisory: FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.0-improper-certificate-validation-in-freerdp-http-request"
}
],
"title": "FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-109245",
"datePublished": "2026-10-12T16:04:20.352Z",
"dateReserved": "2026-10-12T14:07:56.521Z",
"dateUpdated": "2026-10-13T18:01:03.073Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108326 (GCVE-0-2026-108326)
Vulnerability from cvelistv5 – Published: 2026-10-27 17:35 – Updated: 2026-11-04 20:21
VLAI
EPSS
VEX
Title
Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.
Summary
Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-04 19:32 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
Tanium
CNA
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Tanium | Endpoint Configuration Toolset Solution |
Affected:
1.51 , < 1.51.60
(custom)
Affected: 1.59 , < 1.59.50 (custom) Affected: 1.71 , < 1.71.25 (custom) |
|
| Tanium | cx-stream |
Affected:
2.4.1184 , < 2.4.1184
(semver)
Affected: 2.7.1160 , < 2.7.1160 (semver) Affected: 2.8.1465 , < 2.8.1465 (semver) Affected: 2.9.561 , < 2.9.561 (semver) |
Date Public
2026-10-27 17:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108326",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-04T19:32:21.929659Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T20:21:57.540Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Endpoint Configuration Toolset Solution",
"vendor": "Tanium",
"versions": [
{
"lessThan": "1.51.60",
"status": "affected",
"version": "1.51",
"versionType": "custom"
},
{
"lessThan": "1.59.50",
"status": "affected",
"version": "1.59",
"versionType": "custom"
},
{
"lessThan": "1.71.25",
"status": "affected",
"version": "1.71",
"versionType": "custom"
}
]
},
{
"product": "cx-stream",
"vendor": "Tanium",
"versions": [
{
"lessThan": "2.4.1184",
"status": "affected",
"version": "2.4.1184",
"versionType": "semver"
},
{
"lessThan": "2.7.1160",
"status": "affected",
"version": "2.7.1160",
"versionType": "semver"
},
{
"lessThan": "2.8.1465",
"status": "affected",
"version": "2.8.1465",
"versionType": "semver"
},
{
"lessThan": "2.9.561",
"status": "affected",
"version": "2.9.561",
"versionType": "semver"
}
]
}
],
"dateAssigned": "2026-10-09T19:21:32.598Z",
"datePublic": "2026-10-27T17:26:18.042Z",
"descriptions": [
{
"lang": "en",
"value": "Tanium addressed an improper certificate validation vulnerability in Stream Client Extension."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T17:35:05.870Z",
"orgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"shortName": "Tanium"
},
"references": [
{
"name": "TAN-2026-060",
"url": "https://security.tanium.com/TAN-2026-060"
}
],
"title": "Tanium addressed an improper certificate validation vulnerability in Stream Client Extension."
}
},
"cveMetadata": {
"assignerOrgId": "3938794e-25f5-4123-a1ba-5cbd7f104512",
"assignerShortName": "Tanium",
"cveId": "CVE-2026-108326",
"datePublished": "2026-10-27T17:35:05.870Z",
"dateReserved": "2026-10-09T19:21:32.766Z",
"dateUpdated": "2026-11-04T20:21:57.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108185 (GCVE-0-2026-108185)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:29 – Updated: 2026-10-15 19:14
VLAI
EPSS
VEX
Summary
Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 17:34 UTC
CWE
- CWE-295 - Improper certificate validation
Assigner
Zoom
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zoom Communications | Zoom Clients |
Affected:
see references
(custom)
|
Date Public
2026-10-13 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108185",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T17:34:20.289928Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:14:57.702Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows",
"MacOS",
"Linux",
"iOS",
"Android"
],
"product": "Zoom Clients",
"vendor": "Zoom Communications",
"versions": [
{
"status": "affected",
"version": "see references",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-10-13T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.\u003c/p\u003e"
}
],
"value": "Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper certificate validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:29:48.575Z",
"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
"shortName": "Zoom"
},
"references": [
{
"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-26022"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
"assignerShortName": "Zoom",
"cveId": "CVE-2026-108185",
"datePublished": "2026-10-13T14:29:48.575Z",
"dateReserved": "2026-10-09T17:15:48.426Z",
"dateUpdated": "2026-10-15T19:14:57.702Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108184 (GCVE-0-2026-108184)
Vulnerability from cvelistv5 – Published: 2026-10-13 14:28 – Updated: 2026-10-15 19:14
VLAI
EPSS
VEX
Summary
Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 17:33 UTC
CWE
- CWE-295 - Improper certificate validation
Assigner
Zoom
CNA
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Zoom Communications | Zoom Clients |
Affected:
see references
(custom)
|
Date Public
2026-10-13 12:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108184",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-15T17:33:52.310494Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-15T19:14:57.833Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Zoom Clients",
"vendor": "Zoom Communications",
"versions": [
{
"status": "affected",
"version": "see references",
"versionType": "custom"
}
]
}
],
"datePublic": "2026-10-13T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.\u003c/p\u003e"
}
],
"value": "Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper certificate validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T14:28:33.249Z",
"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
"shortName": "Zoom"
},
"references": [
{
"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-26021"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
"assignerShortName": "Zoom",
"cveId": "CVE-2026-108184",
"datePublished": "2026-10-13T14:28:33.249Z",
"dateReserved": "2026-10-09T17:15:48.426Z",
"dateUpdated": "2026-10-15T19:14:57.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108131 (GCVE-0-2026-108131)
Vulnerability from cvelistv5 – Published: 2026-10-13 19:01 – Updated: 2026-10-31 18:13
VLAI
EPSS
VEX
Title
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Summary
No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 19:24 UTC
Assigner
microsoft
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerabi… | vendor-advisorypatch |
Impacted products
21 products
| Vendor | Product | Version | |
|---|---|---|---|
| Microsoft | Windows 10 Version 1607 |
Affected:
10.0.14393.0 , < 10.0.14393.9612
(custom)
|
|
| Microsoft | Windows 10 Version 1809 |
Affected:
10.0.17763.0 , < 10.0.17763.9376
(custom)
|
|
| Microsoft | Windows 10 Version 21H2 |
Affected:
10.0.19044.0 , < 10.0.19044.7807
(custom)
|
|
| Microsoft | Windows 10 Version 22H2 |
Affected:
10.0.19045.0 , < 10.0.19045.7807
(custom)
|
|
| Microsoft | Windows 11 version 23H2 |
Affected:
10.0.22631.0 , < 10.0.22631.7652
(custom)
|
|
| Microsoft | Windows 11 Version 23H2 |
Affected:
10.0.22631.0 , < 10.0.22631.7652
(custom)
|
|
| Microsoft | Windows 11 Version 24H2 |
Affected:
10.0.26100.0 , < 10.0.26100.9711
(custom)
|
|
| Microsoft | Windows 11 Version 25H2 |
Affected:
10.0.26200.0 , < 10.0.26200.9711
(custom)
|
|
| Microsoft | Windows 11 version 26H1 |
Affected:
10.0.28000.0 , < 10.0.28000.3231
(custom)
|
|
| Microsoft | Windows 11 Version 26H2 |
Affected:
10.0.26300.0 , < 10.0.26300.9711
(custom)
|
|
| Microsoft | Windows Server 2012 |
Affected:
6.2.9200.0 , < 6.2.9200.26434
(custom)
|
|
| Microsoft | Windows Server 2012 (Server Core installation) |
Affected:
6.2.9200.0 , < 6.2.9200.26434
(custom)
|
|
| Microsoft | Windows Server 2012 R2 |
Affected:
6.3.9600.0 , < 6.3.9600.23470
(custom)
|
|
| Microsoft | Windows Server 2012 R2 (Server Core installation) |
Affected:
6.3.9600.0 , < 6.3.9600.23470
(custom)
|
|
| Microsoft | Windows Server 2016 |
Affected:
10.0.14393.0 , < 10.0.14393.9612
(custom)
|
|
| Microsoft | Windows Server 2016 (Server Core installation) |
Affected:
10.0.14393.0 , < 10.0.14393.9612
(custom)
|
|
| Microsoft | Windows Server 2019 |
Affected:
10.0.17763.0 , < 10.0.17763.9376
(custom)
|
|
| Microsoft | Windows Server 2019 (Server Core installation) |
Affected:
10.0.17763.0 , < 10.0.17763.9376
(custom)
|
|
| Microsoft | Windows Server 2022 |
Affected:
10.0.20348.0 , < 10.0.20348.5761
(custom)
|
|
| Microsoft | Windows Server 2025 |
Affected:
10.0.26100.0 , < 10.0.26100.33650
(custom)
|
|
| Microsoft | Windows Server 2025 (Server Core installation) |
Affected:
10.0.26100.0 , < 10.0.26100.33650
(custom)
|
Date Public
2026-10-13 14:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108131",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T19:24:04.459842Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T19:25:11.855Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 1607",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.14393.9612",
"status": "affected",
"version": "10.0.14393.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 1809",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.17763.9376",
"status": "affected",
"version": "10.0.17763.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 21H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.19044.7807",
"status": "affected",
"version": "10.0.19044.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"32-bit Systems",
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 10 Version 22H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.19045.7807",
"status": "affected",
"version": "10.0.19045.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems"
],
"product": "Windows 11 version 23H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.22631.7652",
"status": "affected",
"version": "10.0.22631.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows 11 Version 23H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.22631.7652",
"status": "affected",
"version": "10.0.22631.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 11 Version 24H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.26100.9711",
"status": "affected",
"version": "10.0.26100.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 11 Version 25H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.26200.9711",
"status": "affected",
"version": "10.0.26200.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 11 version 26H1",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.28000.3231",
"status": "affected",
"version": "10.0.28000.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"ARM64-based Systems",
"x64-based Systems"
],
"product": "Windows 11 Version 26H2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.26300.9711",
"status": "affected",
"version": "10.0.26300.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2012",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.2.9200.26434",
"status": "affected",
"version": "6.2.9200.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2012 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.2.9200.26434",
"status": "affected",
"version": "6.2.9200.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2012 R2",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.3.9600.23470",
"status": "affected",
"version": "6.3.9600.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2012 R2 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "6.3.9600.23470",
"status": "affected",
"version": "6.3.9600.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2016",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.14393.9612",
"status": "affected",
"version": "10.0.14393.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2016 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.14393.9612",
"status": "affected",
"version": "10.0.14393.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2019",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.17763.9376",
"status": "affected",
"version": "10.0.17763.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2019 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.17763.9376",
"status": "affected",
"version": "10.0.17763.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2022",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.20348.5761",
"status": "affected",
"version": "10.0.20348.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2025",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.26100.33650",
"status": "affected",
"version": "10.0.26100.0",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems"
],
"product": "Windows Server 2025 (Server Core installation)",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "10.0.26100.33650",
"status": "affected",
"version": "10.0.26100.0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "6.2.9200.26434",
"versionStartIncluding": "6.2.9200.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "6.2.9200.26434",
"versionStartIncluding": "6.2.9200.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "6.3.9600.23470",
"versionStartIncluding": "6.3.9600.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "6.3.9600.23470",
"versionStartIncluding": "6.3.9600.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
"versionEndExcluding": "10.0.14393.9612",
"versionStartIncluding": "10.0.14393.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.14393.9612",
"versionStartIncluding": "10.0.14393.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.14393.9612",
"versionStartIncluding": "10.0.14393.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
"versionEndExcluding": "10.0.17763.9376",
"versionStartIncluding": "10.0.17763.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.17763.9376",
"versionStartIncluding": "10.0.17763.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.17763.9376",
"versionStartIncluding": "10.0.17763.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*",
"versionEndExcluding": "10.0.19044.7807",
"versionStartIncluding": "10.0.19044.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x86:*",
"versionEndExcluding": "10.0.19045.7807",
"versionStartIncluding": "10.0.19045.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.20348.5761",
"versionStartIncluding": "10.0.20348.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*",
"versionEndExcluding": "10.0.22631.7652",
"versionStartIncluding": "10.0.22631.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*",
"versionEndExcluding": "10.0.22631.7652",
"versionStartIncluding": "10.0.22631.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*",
"versionEndExcluding": "10.0.26100.9711",
"versionStartIncluding": "10.0.26100.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*",
"versionEndExcluding": "10.0.26200.9711",
"versionStartIncluding": "10.0.26200.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.26300.9711",
"versionStartIncluding": "10.0.26300.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.26100.33650",
"versionStartIncluding": "10.0.26100.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*",
"versionEndExcluding": "10.0.26100.33650",
"versionStartIncluding": "10.0.26100.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:arm64:*",
"versionEndExcluding": "10.0.28000.3231",
"versionStartIncluding": "10.0.28000.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-10-13T14:00:00.000Z",
"descriptions": [
{
"lang": "en-US",
"value": "No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-31T18:13:26.306Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Active Directory Federation Services (AD FS) Spoofing Vulnerability",
"tags": [
"vendor-advisory",
"patch"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108131"
}
],
"title": "Active Directory Federation Services (AD FS) Spoofing Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2026-108131",
"datePublished": "2026-10-13T19:01:44.899Z",
"dateReserved": "2026-10-09T14:49:54.617Z",
"dateUpdated": "2026-10-31T18:13:26.306Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107685 (GCVE-0-2026-107685)
Vulnerability from cvelistv5 – Published: 2026-10-23 11:00 – Updated: 2026-11-02 15:24
VLAI
EPSS
VEX
Title
WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers
Summary
Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on.
The OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.
This issue affects req_llm: from 1.9.0 before 1.29.0.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 15:22 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
EEF
CNA
References
5 references
| URL | Tags |
|---|---|
| https://github.com/agentjido/req_llm/security/adv… | vendor-advisoryrelated |
| https://cna.erlef.org/cves/CVE-2026-107685.html | related |
| https://osv.dev/vulnerability/EEF-CVE-2026-107685 | related |
| https://github.com/agentjido/req_llm/commit/a389d… | related |
| https://github.com/agentjido/req_llm/commit/c7264… | patch |
Impacted products
Date Public
2026-10-22 20:50
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107685",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T15:22:34.733406Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T15:24:51.535Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/agentjido/req_llm/security/advisories/GHSA-6vww-5m28-f26v"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.hex.pm",
"cpes": [
"cpe:2.3:a:agentjido:req_llm:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.ReqLLM.Streaming.WebSocketSession.Client\u0027",
"\u0027Elixir.ReqLLM.Streaming.WebSocketSession\u0027",
"\u0027Elixir.ReqLLM.Providers.OpenAI.WebSocket\u0027",
"\u0027Elixir.ReqLLM.OpenAI.Realtime\u0027",
"\u0027Elixir.ReqLLM.Providers.OpenAICodex\u0027"
],
"packageName": "req_llm",
"packageURL": "pkg:hex/req_llm",
"product": "req_llm",
"programFiles": [
"lib/req_llm/streaming/web_socket_session/client.ex",
"lib/req_llm/streaming/web_socket_session.ex",
"lib/req_llm/providers/openai/web_socket.ex",
"lib/req_llm/openai/realtime.ex",
"lib/req_llm/providers/openai_codex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.ReqLLM.Streaming.WebSocketSession.Client\u0027:start/3"
},
{
"name": "\u0027Elixir.ReqLLM.Streaming.WebSocketSession\u0027:start_link/2"
},
{
"name": "\u0027Elixir.ReqLLM.Streaming.WebSocketSession\u0027:init/1"
},
{
"name": "\u0027Elixir.ReqLLM.Providers.OpenAI.WebSocket\u0027:start_responses_session/2"
},
{
"name": "\u0027Elixir.ReqLLM.OpenAI.Realtime\u0027:connect/2"
},
{
"name": "\u0027Elixir.ReqLLM.Providers.OpenAICodex\u0027:start_responses_session/2"
}
],
"repo": "https://github.com/agentjido/req_llm",
"vendor": "agentjido",
"versions": [
{
"lessThan": "1.29.0",
"status": "affected",
"version": "1.9.0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://github.com",
"cpes": [
"cpe:2.3:a:agentjido:req_llm:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"\u0027Elixir.ReqLLM.Streaming.WebSocketSession.Client\u0027",
"\u0027Elixir.ReqLLM.Streaming.WebSocketSession\u0027",
"\u0027Elixir.ReqLLM.Providers.OpenAI.WebSocket\u0027",
"\u0027Elixir.ReqLLM.OpenAI.Realtime\u0027",
"\u0027Elixir.ReqLLM.Providers.OpenAICodex\u0027"
],
"packageName": "agentjido/req_llm",
"packageURL": "pkg:github/agentjido/req_llm",
"product": "req_llm",
"programFiles": [
"lib/req_llm/streaming/web_socket_session/client.ex",
"lib/req_llm/streaming/web_socket_session.ex",
"lib/req_llm/providers/openai/web_socket.ex",
"lib/req_llm/openai/realtime.ex",
"lib/req_llm/providers/openai_codex.ex"
],
"programRoutines": [
{
"name": "\u0027Elixir.ReqLLM.Streaming.WebSocketSession.Client\u0027:start/3"
},
{
"name": "\u0027Elixir.ReqLLM.Streaming.WebSocketSession\u0027:start_link/2"
},
{
"name": "\u0027Elixir.ReqLLM.Streaming.WebSocketSession\u0027:init/1"
},
{
"name": "\u0027Elixir.ReqLLM.Providers.OpenAI.WebSocket\u0027:start_responses_session/2"
},
{
"name": "\u0027Elixir.ReqLLM.OpenAI.Realtime\u0027:connect/2"
},
{
"name": "\u0027Elixir.ReqLLM.Providers.OpenAICodex\u0027:start_responses_session/2"
}
],
"repo": "https://github.com/agentjido/req_llm",
"vendor": "agentjido",
"versions": [
{
"lessThan": "c7264fc0217fbacfb5562234ff790b8e4462de76",
"status": "affected",
"version": "a389d718640ceb2d541a8f540ab954cbf5ef8313",
"versionType": "git"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:agentjido:req_llm:*:*:*:*:*:*:*:*",
"versionEndExcluding": "1.29.0",
"versionStartIncluding": "1.9.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Neil Berkman"
},
{
"lang": "en",
"type": "finder",
"value": "Neil Berkman"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Mike Hostetler"
},
{
"lang": "en",
"type": "coordinator",
"value": "Jonatan M\u00e4nnchen / EEF"
}
],
"dateAssigned": "2026-10-23T09:11:51.000Z",
"datePublic": "2026-10-22T20:50:53.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the \u003ccode\u003eauthorization\u003c/code\u003e bearer token, via a TLS certificate the client does not trust. \u003ccode\u003eReqLLM.Streaming.WebSocketSession.Client.start/3\u003c/code\u003e in \u003ccode\u003elib/req_llm/streaming/web_socket_session/client.ex\u003c/code\u003e starts WebSockex without TLS options, and WebSockex defaults to \u003ccode\u003einsecure: true\u003c/code\u003e, which connects with \u003ccode\u003everify: :verify_none\u003c/code\u003e. The option allowlist also drops any caller-supplied \u003ccode\u003ecacerts\u003c/code\u003e or \u003ccode\u003essl_options\u003c/code\u003e, so an application cannot turn verification on.\u003c/p\u003e\n\u003cp\u003eThe OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the \u003ccode\u003eauthorization\u003c/code\u003e header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.\u003c/p\u003e\n\u003cp\u003eThis issue affects req_llm: from 1.9.0 before 1.29.0.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the `authorization` bearer token, via a TLS certificate the client does not trust. `ReqLLM.Streaming.WebSocketSession.Client.start/3` in `lib/req_llm/streaming/web_socket_session/client.ex` starts WebSockex without TLS options, and WebSockex defaults to `insecure: true`, which connects with `verify: :verify_none`. The option allowlist also drops any caller-supplied `cacerts` or `ssl_options`, so an application cannot turn verification on.\n\nThe OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the `authorization` header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.\n\nThis issue affects req_llm: from 1.9.0 before 1.29.0."
}
],
"value": "Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on.\n\nThe OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected.\n\nThis issue affects req_llm: from 1.9.0 before 1.29.0."
}
],
"impacts": [
{
"capecId": "CAPEC-94",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn attacker on the network path between an application and the OpenAI endpoint presents their own certificate, obtains the OpenAI API key or OAuth access token and the full session content, and can alter model output and tool calls before the application acts on them. Every application that uses the OpenAI Responses, Realtime, or Codex WebSocket paths is affected.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "An attacker on the network path between an application and the OpenAI endpoint presents their own certificate, obtains the OpenAI API key or OAuth access token and the full session content, and can alter model output and tool calls before the application acts on them. Every application that uses the OpenAI Responses, Realtime, or Codex WebSocket paths is affected."
}
],
"value": "An attacker on the network path between an application and the OpenAI endpoint presents their own certificate, obtains the OpenAI API key or OAuth access token and the full session content, and can alter model output and tool calls before the application acts on them. Every application that uses the OpenAI Responses, Realtime, or Codex WebSocket paths is affected."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T11:00:38.975Z",
"orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"shortName": "EEF"
},
"references": [
{
"name": "WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers",
"tags": [
"vendor-advisory",
"related"
],
"url": "https://github.com/agentjido/req_llm/security/advisories/GHSA-6vww-5m28-f26v"
},
{
"name": "EEF CNA record for CVE-2026-107685",
"tags": [
"related"
],
"url": "https://cna.erlef.org/cves/CVE-2026-107685.html"
},
{
"name": "OSV record EEF-CVE-2026-107685",
"tags": [
"related"
],
"url": "https://osv.dev/vulnerability/EEF-CVE-2026-107685"
},
{
"name": "Introducing commit a389d71 in agentjido/req_llm",
"tags": [
"related"
],
"url": "https://github.com/agentjido/req_llm/commit/a389d718640ceb2d541a8f540ab954cbf5ef8313"
},
{
"name": "Fix commit c7264fc in agentjido/req_llm",
"tags": [
"patch"
],
"url": "https://github.com/agentjido/req_llm/commit/c7264fc0217fbacfb5562234ff790b8e4462de76"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "WebSocket sessions do not verify TLS certificates, exposing API keys and OAuth tokens to on-path attackers",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eLeave the \u003ccode\u003eopenai_stream_transport\u003c/code\u003e provider option at its default \u003ccode\u003e:sse\u003c/code\u003e for the OpenAI and OpenAI Codex providers, and do not call \u003ccode\u003eReqLLM.Providers.OpenAI.WebSocket.start_responses_session/2\u003c/code\u003e directly. Responses streaming then runs over HTTP through Finch, which verifies certificates. \u003ccode\u003eReqLLM.OpenAI.Realtime.connect/2\u003c/code\u003e has no HTTP alternative, so do not use it on an affected version.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "Leave the `openai_stream_transport` provider option at its default `:sse` for the OpenAI and OpenAI Codex providers, and do not call `ReqLLM.Providers.OpenAI.WebSocket.start_responses_session/2` directly. Responses streaming then runs over HTTP through Finch, which verifies certificates. `ReqLLM.OpenAI.Realtime.connect/2` has no HTTP alternative, so do not use it on an affected version."
}
],
"value": "Leave the openai_stream_transport provider option at its default :sse for the OpenAI and OpenAI Codex providers, and do not call ReqLLM.Providers.OpenAI.WebSocket.start_responses_session/2 directly. Responses streaming then runs over HTTP through Finch, which verifies certificates. ReqLLM.OpenAI.Realtime.connect/2 has no HTTP alternative, so do not use it on an affected version."
}
],
"x_proofOfConcept": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003col\u003e\n\u003cli\u003eStart a TLS endpoint on \u003ccode\u003elocalhost\u003c/code\u003e with a self-signed certificate chain that no trust store contains, and let it answer the WebSocket upgrade with \u003ccode\u003e101 Switching Protocols\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eOn a vulnerable version, call \u003ccode\u003eReqLLM.Streaming.WebSocketSession.start_link/2\u003c/code\u003e with \u003ccode\u003ewss://localhost:\u0026lt;port\u0026gt;/socket\u003c/code\u003e and \u003ccode\u003eheaders: [{\"authorization\", \"Bearer \u0026lt;token\u0026gt;\"}]\u003c/code\u003e, then \u003ccode\u003eawait_connected/2\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eawait_connected/2\u003c/code\u003e returns \u003ccode\u003e:ok\u003c/code\u003e, the endpoint completes the TLS handshake, and the endpoint receives the upgrade request carrying the bearer token. On 1.29.0 the same call returns \u003ccode\u003e{:error, %WebSockex.ConnError{original: {:tls_alert, {:unknown_ca, _}}}}\u003c/code\u003e and the endpoint never sees the request.\u003c/li\u003e\n\u003c/ol\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "1. Start a TLS endpoint on `localhost` with a self-signed certificate chain that no trust store contains, and let it answer the WebSocket upgrade with `101 Switching Protocols`.\n2. On a vulnerable version, call `ReqLLM.Streaming.WebSocketSession.start_link/2` with `wss://localhost:\u003cport\u003e/socket` and `headers: [{\"authorization\", \"Bearer \u003ctoken\u003e\"}]`, then `await_connected/2`.\n3. `await_connected/2` returns `:ok`, the endpoint completes the TLS handshake, and the endpoint receives the upgrade request carrying the bearer token. On 1.29.0 the same call returns `{:error, %WebSockex.ConnError{original: {:tls_alert, {:unknown_ca, _}}}}` and the endpoint never sees the request."
}
],
"value": "* Start a TLS endpoint on localhost with a self-signed certificate chain that no trust store contains, and let it answer the WebSocket upgrade with 101 Switching Protocols.\n* On a vulnerable version, call ReqLLM.Streaming.WebSocketSession.start_link/2 with wss://localhost:\u003cport\u003e/socket and headers: [{\"authorization\", \"Bearer \u003ctoken\u003e\"}], then await_connected/2.\n* await_connected/2 returns :ok, the endpoint completes the TLS handshake, and the endpoint receives the upgrade request carrying the bearer token. On 1.29.0 the same call returns {:error, %WebSockex.ConnError{original: {:tls_alert, {:unknown_ca, _}}}} and the endpoint never sees the request."
}
],
"x_technicalAnalysis": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003e1. Entry points.\u003c/strong\u003e \u003ccode\u003eReqLLM.Providers.OpenAI.WebSocket.responses_url/2\u003c/code\u003e and \u003ccode\u003erealtime_url/2\u003c/code\u003e, and the Codex provider\u0027s \u003ccode\u003ecodex_websocket_url/1\u003c/code\u003e, turn the provider base URL into a \u003ccode\u003ewss://\u003c/code\u003e URL and start \u003ccode\u003eReqLLM.Streaming.WebSocketSession\u003c/code\u003e with an \u003ccode\u003eauthorization\u003c/code\u003e header that carries the OpenAI API key or the OAuth access token.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Missing TLS options.\u003c/strong\u003e \u003ccode\u003eWebSocketSession.init/1\u003c/code\u003e passes only the headers and the timeouts to \u003ccode\u003eWebSocketSession.Client.start/3\u003c/code\u003e, and the allowlist in \u003ccode\u003estart/3\u003c/code\u003e forwards only \u003ccode\u003ename\u003c/code\u003e, \u003ccode\u003edebug\u003c/code\u003e, \u003ccode\u003easync\u003c/code\u003e, \u003ccode\u003ehandle_initial_conn_failure\u003c/code\u003e, and the socket timeouts to \u003ccode\u003eWebSockex.start/4\u003c/code\u003e. No \u003ccode\u003einsecure\u003c/code\u003e, \u003ccode\u003ecacerts\u003c/code\u003e, or \u003ccode\u003essl_options\u003c/code\u003e value reaches WebSockex, and a caller cannot inject one.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Insecure default.\u003c/strong\u003e WebSockex 0.5.1 sets \u003ccode\u003einsecure: true\u003c/code\u003e when the option is absent and opens the \u003ccode\u003ewss://\u003c/code\u003e connection through \u003ccode\u003e:ssl.connect/4\u003c/code\u003e with \u003ccode\u003everify: :verify_none\u003c/code\u003e. Any certificate completes the handshake, so an attacker who terminates TLS on the path receives the upgrade request with the bearer token and every frame of the session, and can rewrite frames in either direction.\u003c/p\u003e"
},
{
"base64": false,
"type": "text/markdown",
"value": "**1. Entry points.** `ReqLLM.Providers.OpenAI.WebSocket.responses_url/2` and `realtime_url/2`, and the Codex provider\u0027s `codex_websocket_url/1`, turn the provider base URL into a `wss://` URL and start `ReqLLM.Streaming.WebSocketSession` with an `authorization` header that carries the OpenAI API key or the OAuth access token.\n\n**2. Missing TLS options.** `WebSocketSession.init/1` passes only the headers and the timeouts to `WebSocketSession.Client.start/3`, and the allowlist in `start/3` forwards only `name`, `debug`, `async`, `handle_initial_conn_failure`, and the socket timeouts to `WebSockex.start/4`. No `insecure`, `cacerts`, or `ssl_options` value reaches WebSockex, and a caller cannot inject one.\n\n**3. Insecure default.** WebSockex 0.5.1 sets `insecure: true` when the option is absent and opens the `wss://` connection through `:ssl.connect/4` with `verify: :verify_none`. Any certificate completes the handshake, so an attacker who terminates TLS on the path receives the upgrade request with the bearer token and every frame of the session, and can rewrite frames in either direction."
}
],
"value": "1. Entry points. ReqLLM.Providers.OpenAI.WebSocket.responses_url/2 and realtime_url/2, and the Codex provider\u0027s codex_websocket_url/1, turn the provider base URL into a wss:// URL and start ReqLLM.Streaming.WebSocketSession with an authorization header that carries the OpenAI API key or the OAuth access token.\n\n2. Missing TLS options. WebSocketSession.init/1 passes only the headers and the timeouts to WebSocketSession.Client.start/3, and the allowlist in start/3 forwards only name, debug, async, handle_initial_conn_failure, and the socket timeouts to WebSockex.start/4. No insecure, cacerts, or ssl_options value reaches WebSockex, and a caller cannot inject one.\n\n3. Insecure default. WebSockex 0.5.1 sets insecure: true when the option is absent and opens the wss:// connection through :ssl.connect/4 with verify: :verify_none. Any certificate completes the handshake, so an attacker who terminates TLS on the path receives the upgrade request with the bearer token and every frame of the session, and can rewrite frames in either direction."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
"assignerShortName": "EEF",
"cveId": "CVE-2026-107685",
"datePublished": "2026-10-23T11:00:38.975Z",
"dateReserved": "2026-10-10T13:15:02.316Z",
"dateUpdated": "2026-11-02T15:24:51.535Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107587 (GCVE-0-2026-107587)
Vulnerability from cvelistv5 – Published: 2026-10-08 11:49 – Updated: 2026-10-08 14:13
VLAI
EPSS
VEX
Title
Improper Certificate Validation in hMailServer
Summary
Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. When its recipient opened a signed message, the webmail kept the signer's certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message's From address, and beside any certificate already held for that address. Encrypted mail later sent from the webmail to that address was encrypted to every certificate held for it, so a holder of the kept certificate's key who obtains a copy of such a message can read it.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-08 14:13 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
GitLab
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Progressive Robot Ltd | hMailServer |
Affected:
6.3.2 , < 6.3.6
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107587",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-08T14:13:29.336107Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T14:13:38.084Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "hMailServer",
"repo": "https://gitlab.com/hmailserver/hmailserver",
"vendor": "Progressive Robot Ltd",
"versions": [
{
"lessThan": "6.3.6",
"status": "affected",
"version": "6.3.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Found in the hMailServer project\u0027s own security review (Progressive Robot Ltd)"
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper certificate validation in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker\u0027s key. When its recipient opened a signed message, the webmail kept the signer\u0027s certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message\u0027s From address, and beside any certificate already held for that address. Encrypted mail later sent from the webmail to that address was encrypted to every certificate held for it, so a holder of the kept certificate\u0027s key who obtains a copy of such a message can read it."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T11:49:01.081Z",
"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"shortName": "GitLab"
},
"references": [
{
"url": "https://gitlab.com/hmailserver/hmailserver/-/work_items/66"
},
{
"url": "https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6"
}
],
"solutions": [
{
"lang": "en",
"value": "Upgrade to hMailServer 6.3.6, whose webmail keeps a signer\u0027s certificate only when its chain is trusted, only under the From address the signature was verified for, and a different certificate for an address that has one only when the reader chooses to. After upgrading, review the correspondents\u0027 certificates on the webmail\u0027s Security page and remove any that should not be there. Until then: check the certificates listed for an address before sending it encrypted mail from the webmail, or encrypt in a mail program."
}
],
"title": "Improper Certificate Validation in hMailServer"
}
},
"cveMetadata": {
"assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
"assignerShortName": "GitLab",
"cveId": "CVE-2026-107587",
"datePublished": "2026-10-08T11:49:01.081Z",
"dateReserved": "2026-10-08T11:17:47.802Z",
"dateUpdated": "2026-10-08T14:13:38.084Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107318 (GCVE-0-2026-107318)
Vulnerability from cvelistv5 – Published: 2026-10-08 20:32 – Updated: 2026-10-09 11:50
VLAI
EPSS
VEX
Title
@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports
Summary
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path network attacker can therefore impersonate the configured HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts. The issue is fixed in @fastify/reply-from 12.7.0, and users should upgrade to 12.7.0 or later. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-09 11:50 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
openjs
CNA
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| @fastify/reply-from | @fastify/reply-from |
Affected:
0 , < 12.7.0
(semver)
Unaffected: 12.7.0 (semver) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107318",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-09T11:50:31.702426Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T11:50:42.722Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/@fastify/reply-from",
"product": "@fastify/reply-from",
"vendor": "@fastify/reply-from",
"versions": [
{
"lessThan": "12.7.0",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "12.7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "remediation developer",
"value": "mcollina"
},
{
"lang": "en",
"type": "remediation reviewer",
"value": "UlisesGascon"
},
{
"lang": "en",
"type": "reporter",
"value": "oss-security-shopify"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path network attacker can therefore impersonate the configured HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts. The issue is fixed in @fastify/reply-from 12.7.0, and users should upgrade to 12.7.0 or later. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent."
}
],
"value": "@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream even when the application points it at an https upstream in the default configuration. An on-path network attacker can therefore impersonate the configured HTTPS upstream, read the credentials and request bodies the proxy forwards, and return forged responses that the application trusts. The issue is fixed in @fastify/reply-from 12.7.0, and users should upgrade to 12.7.0 or later. As a workaround, pass an explicit rejectUnauthorized true on the transport, supply an already configured undici instance, or use the undici global agent."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295: Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T20:32:03.483Z",
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs"
},
"references": [
{
"url": "https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-j425-jw94-m29r"
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"title": "@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports",
"x_generator": {
"engine": "cve-kit 1.0.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"assignerShortName": "openjs",
"cveId": "CVE-2026-107318",
"datePublished": "2026-10-08T20:32:03.483Z",
"dateReserved": "2026-10-07T17:27:41.901Z",
"dateUpdated": "2026-10-09T11:50:42.722Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106072 (GCVE-0-2026-106072)
Vulnerability from cvelistv5 – Published: 2026-10-23 16:15 – Updated: 2026-11-02 15:39
VLAI
EPSS
VEX
Summary
A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.
`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Severity
6.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 15:39 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106072",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T15:39:13.874920Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T15:39:59.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThanOrEqual": "22.23.3",
"status": "affected",
"version": "22.23.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.22.0",
"status": "affected",
"version": "24.22.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.12.0",
"status": "affected",
"version": "26.12.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.\n\n`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T16:15:05.783Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-106072",
"datePublished": "2026-10-23T16:15:05.783Z",
"dateReserved": "2026-10-06T15:00:00.655Z",
"dateUpdated": "2026-11-02T15:39:59.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-106069 (GCVE-0-2026-106069)
Vulnerability from cvelistv5 – Published: 2026-10-23 16:15 – Updated: 2026-11-02 13:31
VLAI
EPSS
VEX
Summary
A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.
`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.
This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
Severity
7.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 13:30 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
hackerone
CNA
References
1 reference
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-106069",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T13:30:11.711010Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T13:31:52.012Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "node",
"vendor": "nodejs",
"versions": [
{
"lessThanOrEqual": "22.23.3",
"status": "affected",
"version": "22.23.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "24.22.0",
"status": "affected",
"version": "24.22.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "26.12.0",
"status": "affected",
"version": "26.12.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.\n\n`tls.checkServerIdentity()` normalizes the host following the WHATWG URL rules, which read a leading-zero octet as octal (`0127.0.0.1` becomes `87.0.0.1`), while the connection is made through the operating system resolver, which on some platforms such as macOS reads it as decimal (`127.0.0.1`). A server at the connected address can then be authenticated with a certificate issued for another IP address.\n\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-23T16:15:05.850Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://nodejs.org/en/blog/vulnerability/october-2026-security-releases"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2026-106069",
"datePublished": "2026-10-23T16:15:05.850Z",
"dateReserved": "2026-10-06T15:00:00.654Z",
"dateUpdated": "2026-11-02T13:31:52.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Architecture and Design
Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.