CVE-2026-34873 is a critical security vulnerability affecting Mbed TLS versions 3.5.0 through 4.0.0. It enables an attacker to impersonate a client during the resumption phase of a TLS 1.3 session, due to improper authentication mechanisms (CWE-287). The vulnerability can be exploited remotely without requiring authentication or user interaction, potentially compromising the confidentiality and integrity of communications. The CVSS v3.1 base score is 9.1, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality and integrity. No official patch or remediation guidance is currently provided, and no exploits have been observed in the wild.

Successful exploitation allows an attacker to impersonate a legitimate client during TLS 1.3 session resumption, leading to a critical breach of confidentiality and integrity of the affected communications. This could enable unauthorized access to sensitive data or manipulation of data in transit. There are no known active exploits at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should monitor vendor communications closely. Consider disabling TLS 1.3 session resumption if feasible as a temporary mitigation, but verify compatibility and impact before applying such measures.