DTLS 1.2 Vulnerability in wolfSSL Exposing Clients to Man-in-the-Middle Attacks

CVE-2026-93304

What is CVE-2026-93304?

A vulnerability exists in DTLS 1.2 that allows a client to accept a ChangeCipherSpec message before completing its ClientKeyExchange. This flaw permits an attacker to manipulate the handshake process and present themselves as the authentic server. Though the client maintains proper keys for its outgoing traffic, the out-of-order ChangeCipherSpec enables attackers to deceive the client into accepting potentially harmful data. The vulnerability is particularly critical in scenarios that involve man-in-the-middle attacks, especially when Pre Shared Key (PSK) connections are in use.

References