Authorization Bypass in rfc3161-client Python Library by Trail of Bits

CVE-2026-33753

What is CVE-2026-33753?

The rfc3161-client Python library, which implements the Time-Stamp Protocol, is susceptible to an authorization bypass flaw prior to version 1.0.6. This vulnerability enables attackers to impersonate a legitimate TimeStamping Authority (TSA) through clever manipulation of certificate validation logic. By exploiting a logic flaw in the extraction of the leaf certificate from an unordered PKCS#7 bag, an attacker can craft a spoofed certificate that meets the target common_name and Extended Key Usage (EKU) requirements. As a result, the library erroneously verifies the spoofed certificate against the intended authorization rules while still validating the cryptographic signature against a trusted TSA. This flaw compromises the integrity of TSA authorization, allowing potential misuse of the timestamping functionality.

References