Client Authentication Vulnerability in OCaml-TLS by OCaml
CVE-2026-45389

7.4HIGH

Key Information:

Vendor

OCaml

Status
OCaml-TLS
Vendor
CVE Published:
15 June 2026

What is CVE-2026-45389?

A security vulnerability in OCaml-TLS prior to version 2.1.0 results from inadequate verification of client-provided certificates during authentication processes. Attackers may exploit this flaw to impersonate users by supplying certificates that are not intended for client authentication, bypassing critical security measures intended to ensure identity verification through KeyUsage and ExtendedKeyUsage checks.

References

https://osv.dev/vulnerability/OSEC-2026-07

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.