Weakness (CWE)
CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
How to prevent it (2 mitigations)
-
Architecture and Design, Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
-
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
Source: MITRE CWE-295
480 results · Clear filters · Feed
-
High 7.4
undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before forwarding them to each per-origin pool,…
-
High 8.0
Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) …
-
High 7.5
CAI Content Credentials | Improper Certificate Validation (CWE-295)
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation …
-
High 7.5
CAI Content Credentials | Improper Certificate Validation (CWE-295)
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation …
-
High 7.5
CAI Content Credentials | Improper Certificate Validation (CWE-295)
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation …
-
High 7.5
CAI Content Credentials | Improper Certificate Validation (CWE-295)
CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation …
-
High 7.5
Active Directory Federation Services (AD FS) Spoofing Vulnerability
No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
-
High 7.4
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
-
High 7.4
Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to co…
-
High 7.4
Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an inf…
-
High 7.4
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software do…
-
High 7.4
DataStage on Cloud Pak for Data Improper Certificate Validation
IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token…
-
High 7.4
NetEase Cloud Music TLS Certificate Validation Bypass
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server cert…
-
High 8.1
SWUpdate through 2026.05.1 CMS Signature Verification Bypass via Embedded Intermediates
SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling…
-
High 7.5
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Certificate Valida…
-
High 7.4
@fastify/reply-from vulnerable to improper certificate validation in built-in HTTPS transports
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify…
-
High 7.6
An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0. By supp…
-
High 7.6
Docker Engine insecure-registry fallback via malicious DNS responses
Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single add…
-
High 7.6
Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privil…
-
High 8.2
Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerabilit…
-
High 7.4
maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kub…
-
High 7.4CVE-2026-105221 Public exploit
Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify G…
-
High 7.4
alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to …
-
High 7.4
gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client
gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers to impersonate payment provider APIs. Attackers can present any certificate to read merchant credentials, signatures and…
-
High 7.4
go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper
go-micro before 6.0.0 contains an improper certificate validation vulnerability that allows network attackers to impersonate services because the shared TLS helper sets InsecureSkipVerify to true by default. Man-in-the-middle attackers can present any certifi…
-
High 8.7
PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate
In Bouncy Castle for Java before 1.86, neither copy of PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer nor the legacy org.bouncycastle.x509.PKIXCertPathReviewer - applied X.509 name constraints to the end-entity certificate. checkName…
-
High 7.4
Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Platform
Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle (AiTM). This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not…
-
High 8.2
Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts
Improper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can obtain certificates from, a name-constrained intermediate CA to have certificates accepted during…
-
High 8.2
Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix
Improper certificate validation in the directoryName name-constraint check (PkixNameConstraintValidator.WithinDNSubtree) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who controls, or can have certificates issued by, a name-con…
-
High 8.2
URI name constraints checked against a mis-parsed host
Improper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a name-constrained subordinate CA, or anyone able to obtain certificates with chosen subjectAltName URIs from…
-
High 7.4CVE-2026-15911 Public exploit
Confluent Kafka Python Improper TLS Certificate Validation
Confluent Kafka Python client's HashiCorp Vault KMS integration could allow a remote attacker to obtain sensitive information due to improper TLS certificate validation.
-
High 7.4
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 1.1.35, the executor-legacy-ws buildWSLegacyExecutor() function hardcodes TLS certificate rejection off for Node.js connections to wss:// endpoints. Applications u…
-
High 7.6
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain…
-
High 7.4
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertific…
-
High 8.3
OCSP stapling v2 multi accepts non-CA chain certificates as issuers
In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to certificate forgery. When a wolfSSL client enables OCSP stapling with the HAVE_CERTIFICATE_STATUS_REQUEST_V2 fea…
-
High 8.3
Trusted peer certificate match ignores public key, allowing forged CA clones
MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEER_CERT and load CA certificates with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). The…
-
High 7.4CVE-2026-100835 Public exploit
Contrast before 1.16.0 Remote Attestation Relay Attack
Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correctly and contained the expected firmware patch levels and software measurements, regardless of which machine produced it…
-
High 7.5
Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass
Netty versions from 4.2.11.Final before 4.2.18.Final contain an incomplete hostname verification fix in the QUIC certificate verification path when using a plain X509TrustManager. The BoringSSLCertificateVerifyCallback discards the SSLEngine for plain trust m…
-
High 8.3
OpenClaw iOS Control UI TLS Pin Enforcement Bypass
OpenClaw for iOS versions >= 2026.7.1 and < 2026.8.11 do not enforce saved Gateway TLS pins in the Control UI. While native connections enforced the saved Gateway fingerprint, the authenticated Terminal and session Dashboard WebViews omitted it. If a user had…
-
High 7.1
Zammad: S/MIME signature verification allows forged sender impersonation
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when Zammad checks the digital signature on an incoming S/MIME-signed email, it does not verify that the signing certificate is genuinely trusted, it only checks whether a cer…