CVE-2026-16516: CWE-345 Insufficient Verification of Data Authenticity in wolfSSL Inc. wolfSSH

The vulnerability in wolfSSH (CVE-2026-16516) arises from insufficient verification of data authenticity (CWE-345). Specifically, in the ParseECCPubKey() function, the ECDSA curve identifier in the KEXDH_REPLY host key blob is not validated against the negotiated algorithm during key exchange. The algorithm string from the blob is used to derive the curve without cross-checking with the negotiated public key ID, and the RFC 5656 curve identifier string is discarded rather than compared. This flaw enables an active man-in-the-middle attacker to substitute a host key blob containing a different ECDSA curve. Because the attacker controls the private key for the substituted curve, signature verification succeeds, potentially allowing the attacker to impersonate the host. Exploitation requires an active MitM position and a weak public key verification callback such as trust-on-first-use (TOFU), algorithm-name-only checks, or fingerprint matching against the parsed key.

An active network man-in-the-middle attacker can exploit this vulnerability to substitute the host key blob with one using a different ECDSA curve that the client accepts, enabling the attacker to impersonate the host. This compromises the authenticity of the key exchange and can lead to interception or manipulation of SSH sessions. The vulnerability requires an active MitM position and a lax public key verification callback on the client side.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should ensure strict public key verification callbacks that validate both the algorithm and key fingerprint, avoiding lax checks such as TOFU or algorithm-name-only verification. Monitoring vendor advisories for updates and applying official patches once released is recommended.