The vulnerability involves improper certificate validation (CWE-295) in CISA Malcolm. Specifically, requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify the identity provider's server certificate. This flaw enables an attacker positioned on the network path between the proxy and the identity provider to impersonate the identity provider and issue forged authentication tokens accepted by the deployment.

An attacker who can intercept network traffic between the reverse proxy and the identity provider can impersonate the identity provider and issue forged authentication tokens. This could lead to unauthorized access within the affected deployment. The CVSS 4.0 score is 6 (medium severity), reflecting the requirement for attacker presence on the network path and high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, organizations should consider network-level protections to prevent man-in-the-middle attacks between the reverse proxy and identity provider.