TLS 1.3 Post-Handshake Authentication Flaw in wolfSSL Products

CVE-2026-55962

What is CVE-2026-55962?

A vulnerability in wolfSSL's implementation of TLS 1.3 post-handshake authentication allows servers to accept a client's Finished message without the necessary client Certificate and CertificateVerify. This flaw occurs because the exemption for an empty or absent peer certificate was misapplied to post-handshake scenarios, which should have required these certificates. The fix restricts this exemption to the initial handshake, ensuring that once a post-handshake CertificateRequest has been sent, the server mandates a valid peer certificate and CertificateVerify prior to accepting the Finished message. Only servers utilizing post-handshake authentication and configured to request client certificates are impacted by this security issue.

References