{"id":"CVE-2026-93302","summary":"Trusted peer certificate match ignores public key, allowing forged CA clones","details":"MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro WOLFSSL_TRUST_PEER_CERT and load CA certificates with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). The peer must know the certificates being loaded to either of those APIs to take advantage of the issue. When OPENSSL_COMPATIBLE_DEFAULTS is also defined this widens the affected API to include all CA certificate loading. Both macros are defined when using autoconf builds such as (nginx, haproxy, stunnel, wpas, apache httpd, hitch, bind, rsyslog, ffmpeg, all, distro). When the certificate is listed as a trusted peer certificate the issue previously allowed for a malicious (D)TLS server to bypass authentication once knowing which CA’s the client would accept. This also affects mutual authentication cases where the client knows which CA’s the server has loaded. If building with any of these configurations and using (D)TLS where the loaded CA’s could be known and authentication of the peer is desired, users should either: update to the latest wolfSSL version, apply the fix patch, or use the configure flag --disable-openssl-compatible-defaults and not load CA’s with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert() to mitigate the issue.","modified":"2026-09-29T08:01:53.379390Z","published":"2026-09-27T09:07:35.999Z","database_specific":{"cna_assigner":"wolfSSL","cwe_ids":["CWE-295"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93302.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93302.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-93302"},{"type":"FIX","url":"https://github.com/wolfSSL/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wolfssl/wolfssl","events":[{"introduced":"e722c15be860794179082a05d09e6a90dc77ccf0"},{"fixed":"22bcd51d553eaac1de37bee91fdac80cc47961e1"}],"database_specific":{"extracted_events":[{"introduced":"5.3.0"},{"last_affected":"5.9.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v5.9.2-stable","v5.9.1-stable","v5.9.0-stable","v5.8.4-stable","wolfEntropy2d","v5.8.2-stable","wolfEntropy1","v5.8.0-stable","v5.7.6-stable","v5.7.4-stable","v5.2.1","v5.7.2-stable","v5.7.0-stable","v5.6.6-stable","v5.6.4-stable","v5.6.2-stable","v5.6.3-stable","v5.6.0-stable","v5.5.4-stable","v5.5.3-stable","v5.5.2-stable","v5.5.1-stable","v5.5.0-stable","v5.4.0-stable","v5.3.0-stable"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93302.json","vanir_signatures_modified":"2026-09-29T08:01:53Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/wolfssl/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1","target":{"file":"wolfcrypt/src/asn.c"},"deprecated":false,"digest":{"line_hashes":["188267075533113520906882948718723987754","264660685121835464369798465086590158989","92095369765191777216187809030923605625","180838849381168971431564842044026001239","108468919539737682461201858512396798818","226499012278946725076348894304229805338","86416939291687880230326604459838258987","325087196536758885899950499538000105358","70210828908277868446824689180166281232","269088063093854528491392306003626273529","304805027629151291494606053253779988326","292209862787593427209280061208701340054","195175447581906296268488830997705571149"],"threshold":0.9},"id":"CVE-2026-93302-0acb36b8"},{"deprecated":false,"digest":{"length":29145,"function_hash":"5141762205270381109412447001254001238"},"id":"CVE-2026-93302-225fd873","signature_type":"Function","signature_version":"v1","source":"https://github.com/wolfssl/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1","target":{"file":"src/internal.c","function":"ProcessPeerCerts"}},{"target":{"file":"src/ssl_certman.c","function":"GetTrustedPeer"},"deprecated":false,"digest":{"function_hash":"311066181815009989061569041624135788350","length":851},"id":"CVE-2026-93302-5b82ab4d","signature_type":"Function","signature_version":"v1","source":"https://github.com/wolfssl/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1"},{"deprecated":false,"digest":{"line_hashes":["306761079724349155498048051533289431568","170023032990885712595468058852201701175","61449826228983555781724823452553808113","251569236977714686252512149320054803733","47694937790163443687666696636819779178","103278080222417837987903046753977168885","129576700147503497592839997702200460236","85210285116987226283910832222117144374","234746323830830864196558223730745391007","333088176533900901312389574768123084553","173218731433438527502470706272381030374","223084513616810523961954925543489556580","16155873953478138131065578911703215479","219399854553124345129030734652894788246","37764072640035132819767353334319842561","327316801142085151841942642543603632454","262618554722087796529989355527735568955","187807666240157300015266076714736988977","297425303087425621876701986227711054842"],"threshold":0.9},"id":"CVE-2026-93302-93a07781","signature_type":"Line","signature_version":"v1","source":"https://github.com/wolfssl/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1","target":{"file":"wolfssl/wolfcrypt/asn.h"}},{"id":"CVE-2026-93302-956acb05","signature_type":"Line","signature_version":"v1","source":"https://github.com/wolfssl/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1","target":{"file":"src/ssl_certman.c"},"deprecated":false,"digest":{"line_hashes":["11581552007341206250591512788273007718","299216065602863552800045900792814118256","133699802877974402525655947872218683486","50430766758535100591619619179270305459","36584850946329252970365622442386612677","264194021825805157372899387207280160544","154384387440006584774027025163790342804","139040576606065325301830077587589267578","166622442417686171235982888226579881354","264363432001754714004108766083202106892","23872664063042266196887621969431115578","260313753892692234314176024823372166018","45016252506322842361939504312793860835","23718443775243187588595204229517284688","283557866875685414986124605630853249726","37523509190362605908828782497751218880","309516238780875867299590662331926121500","193561058818654567168960169455960813713","330399429602158976214368761987492197509","241996269493631027489569743782742157496","8740366041790137587807100421494802187","77025174788029682520564218389093312348","137028504613671197047156206739640663947","198859357660885946279737502990183290625","166160896948421716427631412043528517921","267958333423717364289060728944527835272","183533274298871795750941101995245003717","333575341018681611770783215209981891461","178606038763596572507664186982241247763","21758942384536089063403316333409206029","293962413144221651183814200027570573318","324330678283643838592546635494547365730","33098353212907362498855781842192977719","159244704342024925541475762609219640037","20487016423909398836042705412396517187","240562943577871356498304473935781311704","159880367531878909852097711219025097828","63796175412625667212834587410477283458","335053793998034980065847205436523799232","45016252506322842361939504312793860835","23718443775243187588595204229517284688","283557866875685414986124605630853249726","37523509190362605908828782497751218880","309516238780875867299590662331926121500","193561058818654567168960169455960813713","330399429602158976214368761987492197509","241996269493631027489569743782742157496","24145442979484276315181163229363366070","241663514160444228215213979822992746170","250176248276003292480102113553256764951","100994939588658114779561776855345031778","235085440838328774463139042658771291355","254588815549480519576572966578419686553","329707301152231472388477626176867809525","110084512883833978258756357119656837992","55719362293195236194443693030749124114","219649945221681792909222732044353105272","155023027445038665545702124795089960975","94821464503792075761678122257627915603","231921800394488039353450762586076175422","212380080251560538999583825923332917225","227876928101280148505439070325602516323","42240610504519120925556734519852155216","102023304767793128475178945005890140299","333348288231452995893046727774824937577","161504086455748122574502239451828237328","182481198093630746299397778232610393921","94211149798762997868711184814480560768","334980400879301253161381388688054676673","261849110489886459557949550844718371312","274202252150686800448233697433905812991","189375253014437245257907157945895840130","187407278316200484694476994834574834729","229680770022341720183134434656013875135","3978893132162924941544040147241287904","307083619903283484677926331541614643337","116233855840233089997369604004629978006","2026830789067229391394155694880107126","39754803442102274252272658625538995042","18736077629057449555045274407523741161","305167788930005653148912682097303123839","52807987883795797511474543402345044385","245333340156701812819397247324524509037","234496923123254227167972637090461807789","185679913695940114673246775253115075558","77601522590015233329007264314082415609","155980917977929693983769484897467279732","75174939721565229141847700481010138849","253341730321617434507477867008076948765","64612364166753392461317083966340036401","38886434817444180910380002246875512456","100935644131205602836072496797200592690","105414860934016407938646823296290363193","173223156177544514179119087307438063917","297865618234399969506977015219175641336","305811237110383158955913592754212554407","33383779184838605175374214445472858229","71246267060067627664519048902634201496","70582929904620535325530209732697386230","7915161065684623430408484951509973616","142969637556704036422321319562490358955","242575107268374523030925149899415195875","34391079066846054146055419195790967020","262964015039549142287634893497287144554","98459320470379928356925720056945718403","305148771075548853935634121086674817752","320999146188874331771144982790070424215","311285335315462749206533951914790918052","225017230342396462233486805922187925328","333358373371736326318383099608306572579","16041058630356811558561624985071079453","177795792771616708725672560663619079101","17536947580561426019645889434275420920","53326953030767246173510222575866205050","38541910166526762585294809879383498492","240253088993167858065620903897879727749","201393348599710005812384798556097798068","140747139680730530555666267889305821626","138404050944661714643784957521895924352","249559718688638699806782521578914474485","118996432750063122047976274264958618826","200785941515767312318935955625019147901","251727171897808294780713930812308842093","23601235378825586969397093776321598435","339372432508695952990598413258258103295","253341730321617434507477867008076948765","172201239317222546038541202563392945283","307869438003181919326675829974635216562","64803260192904003561059570045851969235","25582088965145671580434486264951693505","2902251127185598123711361804082890280","53180007784974932086089335429469931847"],"threshold":0.9}},{"digest":{"function_hash":"63706086806206101525786763543073042219","length":742},"id":"CVE-2026-93302-98fe62e2","signature_type":"Function","signature_version":"v1","source":"https://github.com/wolfssl/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1","target":{"file":"src/ssl_certman.c","function":"AlreadyTrustedPeer"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"183928770320562057837128688573366752235","length":2841},"id":"CVE-2026-93302-a30847fb","signature_type":"Function","signature_version":"v1","source":"https://github.com/wolfssl/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1","target":{"function":"AddTrustedPeer","file":"src/ssl_certman.c"}},{"target":{"file":"src/ssl_certman.c","function":"MatchTrustedPeer"},"deprecated":false,"digest":{"function_hash":"53156360576930717927927734176690980233","length":324},"id":"CVE-2026-93302-c20aa991","signature_type":"Function","signature_version":"v1","source":"https://github.com/wolfssl/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1"},{"deprecated":false,"digest":{"line_hashes":["84621220541742102018919262385515995329","77355916510002701513503997173838058160","140218042458829543660700598830476207146","331789731460354053149672259534900607371","205705359529925494349783019369520800063","329062009219617294505010406298791012694","165354491470641218571384004111341220007","266032087958293901649535362512832916976","336926158970045343971994400863981940408","267680328697110908084119818777534461488","253217183191163059982389549038456944473","160127577254166024923293238578084443579","302968748201118475619308592895245058500"],"threshold":0.9},"id":"CVE-2026-93302-d1defaf3","signature_type":"Line","signature_version":"v1","source":"https://github.com/wolfssl/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1","target":{"file":"src/internal.c"}},{"deprecated":false,"digest":{"function_hash":"206453029151273259564280057196016491364","length":494},"id":"CVE-2026-93302-da39d419","signature_type":"Function","signature_version":"v1","source":"https://github.com/wolfssl/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1","target":{"function":"FreeTrustedPeer","file":"wolfcrypt/src/asn.c"}},{"digest":{"line_hashes":["252010165272399258898121213811476578157","106058023434601852994276692007321171648","76244280376320248391255442887222425386","94324253835831381635117727296231753313","98371093805835799759404612989252212263"],"threshold":0.9},"id":"CVE-2026-93302-e7844a4a","signature_type":"Line","signature_version":"v1","source":"https://github.com/wolfssl/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1","target":{"file":"wolfssl/internal.h"},"deprecated":false}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N"}]}