Client Certificate Authentication Flaw in wolfssl Python Package

CVE-2025-15346

What is CVE-2025-15346?

A flaw in the wolfssl Python package's handling of the certificate verification mode allows for insufficient enforcement of client certificate requirements. Specifically, when the WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT flag is absent, the system incorrectly treats client certificates as optional. This misconfiguration means that while a peer certificate is verified when present, connections can be established without a client certificate, effectively bypassing mutual TLS (mTLS) authentication during the TLS handshake. This vulnerability impacts all versions prior to 5.8.4.

References