CVE-2025-15346 json
wolfSSL Python library `CERT_REQUIRED` mode fails to enforce client certificate requirement
published 2026-01-07 10 mo ago modified 2026-10-07 33 d ago also GHSA-vj87-jj27-4h9c , PYSEC-2026-575 , EUVD-2026-1463
- cvss
- 9.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 26%
- public exploits
- 0
- none known
Summary
A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be fully enforced.
Because the WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT flag was not included, the behavior effectively matched CERT_OPTIONAL: a peer certificate was verified if presented, but connections were incorrectly authenticated when no client certificate was provided.
This results in improper authentication, allowing attackers to bypass mutual TLS (mTLS) client authentication by omitting a client certificate during the TLS handshake.
The issue affects versions up to and including 5.8.2.
Patch / fix
- pypi wolfssl 5.8.4.post0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 10 mo ago
Exploit prediction
0.33% chance of exploitation in the next 30 days, higher than 26% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/AU:Y |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | wolfssl | <5.8.4.post0 |
5.8.4.post0 |
Affected products
- wolfSSL wolfSSL-py
Classification
References
-
github.com
/wolfSSL/wolfssl-py/pull/62
web
-
github.com
/wolfSSL/wolfssl-py/commit/b4517dece79f682a8f453abce5cfc0b81bae769d
web
-
github.com
/wolfSSL/wolfssl-py/releases/tag/v5.8.4-stable
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-15346
advisory
-
github.com
/wolfSSL/wolfssl-py
package
-
pypi.org
/project/wolfssl
package
-
github.com
/advisories/GHSA-vj87-jj27-4h9c
advisory
Sources
- CVE List CVE-2025-15346
- GitHub Advisory GHSA-vj87-jj27-4h9c
- NVD CVE-2025-15346
- OSV PYSEC-2026-575
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.