Skip to content
OpenAdvisories

Weakness (CWE)

CWE-297: Improper Validation of Certificate with Host Mismatch

Variant Incomplete

The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

How to prevent it (3 mitigations)

  1. Architecture and Design

    In order to ensure data integrity, the certificate must be valid, and it must pertain to the site that is being accessed.Fully check the hostname of the certificate and provide the user with adequate information about the nature of the problem and how to proceed.

  2. Implementation

    If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

  3. Implementation

    Be careful of other weaknesses in the code that checks the hostname, since it is still possible to incorrectly check the hostname. For example, attackers could create a certificate with a name that begins with a trusted name followed by a NUL byte, which could cause some string-based comparisons to only examine the portion that contains the trusted name.

Source: MITRE CWE-297

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-58040 Public exploit

    An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…

    nodejs node nodejs nodejs Debian Ubuntu Alpine
  • Medium 6.8
    CVE-2026-22747 Public exploit

    Unauthorized User Impersonation when Using X.509 Client Certificates

    Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an…

    Spring Spring Security org.springframework.security:spring-security-web Maven
  • Medium 6.5
    CVE-2024-32868 Public exploit

    ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass

    ZITADEL provides users the possibility to use Time-based One-Time-Password (TOTP) and One-Time-Password (OTP) through SMS and Email. While ZITADEL already gives administrators the option to define a `Lockout Policy` with a maximum amount of failed password ch…

    zitadel zitadel github.com/zitadel/zitadel Go