This vulnerability arises from an incomplete fix of CVE-2026-6731 in wolfSSL 5.9.2. The certificate validation logic incorrectly gates the CN-as-DNS fallback on the presence of cert->altNames being NULL rather than specifically checking for the absence of dNSName SAN entries. As a result, certificates that lack dNSName SAN but include other SAN types bypass the intended name-constraint checks, allowing an out-of-scope CN to be accepted.

The vulnerability allows an attacker to bypass name-constraint checks in certificate validation, potentially leading to acceptance of certificates with unauthorized domain names. This can undermine the integrity of TLS connections, enabling impersonation or man-in-the-middle attacks. The CVSS score is 9.1, indicating high severity with high impact on integrity and availability, though confidentiality impact is not indicated.

No explicit patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider additional certificate validation controls or avoid using affected wolfSSL versions if possible.