Peer Certificate Verification Bypass in wolfSSL Affects Multiple Products

CVE-2026-93302

What is CVE-2026-93302?

A bypass issue in wolfSSL's MatchTrustedPeer function allows forged certificate authority (CA) clones to pass verification checks. This flaw impacts any builds where the macro WOLFSSL_TRUST_PEER_CERT is enabled, allowing the malicious (D)TLS server to potentially bypass authentication by manipulating the CA certificates. The vulnerability extends when OPENSSL_COMPATIBLE_DEFAULTS is also defined, affecting all CA certificate loading within several applications including nginx, haproxy, stunnel, and more. To safeguard against this vulnerability, users are advised to update to the latest version of wolfSSL, apply the provided patch, or modify their build configuration to disable the problematic macros.

References