Skip to content
OpenAdvisories

Weakness (CWE)

CWE-322: Key Exchange without Entity Authentication

Base Draft

The product performs a key exchange with an actor without verifying the identity of that actor.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Ensure that proper authentication is included in the system design.

  2. Implementation

    Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.

Source: MITRE CWE-322

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.5
    CVE-2026-33697 Public exploit

    CoCoS attested TLS is vulnerable to relay attacks via extracted ephemeral TLS keys

    Cocos AI is a confidential computing system for AI. The current implementation of attested TLS (aTLS) in CoCoS is vulnerable to a relay attack affecting all versions from v0.4.0 through v0.8.2. This vulnerability is present in both the AMD SEV-SNP and Intel T…

    ultravioletrs cocos