Insecure TLS Verification in Cocos by Ultravioletrs
CVE-2026-92701

9.1CRITICAL

Key Information:

Vendor

Ultravioletrs

Status
Cocos
Vendor
CVE Published:
18 September 2026

What is CVE-2026-92701?

An issue in Cocos versions up to and including 0.8.2 allows for the acceptance of structurally valid TDX QuoteV4 Evidence without a thorough validation of the REPORT_DATA field. This flaw arises from the failure to transfer the expected current-session freshness value into the TDX quote-body policy prior to quote validation. As a result, a relying party can incorrectly accept evidence that has mismatched or reused reportData, potentially leading to session-misbinding within unintended attestation contexts. Users should upgrade to version 0.9.0 or later to mitigate this risk.

Affected Version(s)

cocos < 0.9.0

References

https://github.com/ultravioletrs/cocos/security/advisorie...
x_refsource_CONFIRM
https://github.com/ultravioletrs/cocos/releases/tag/v0.9.0
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.