The wolfSSL_PKCS7_verify() function in OpenSSL compatibility builds of wolfSSL previously returned success for PKCS#7 objects that contained no signer information (empty signerInfos). This allowed the signed-data verification to succeed without any actual signature verification, effectively authenticating unsigned content. The vulnerability is specific to the compatibility-layer API PKCS7_verify() when used on degenerate (certs-only) PKCS#7 bundles. The fix enforces rejection of such objects if no signer signature is verified, independent of the PKCS7_NOVERIFY flag, which only suppresses certificate chain validation but does not waive the requirement for a signature.

This vulnerability could allow an attacker to bypass signature verification by providing a PKCS#7 object with no valid signer signature, leading to false verification success and potential acceptance of unauthenticated content. This undermines the integrity guarantees of PKCS#7 signed data in affected wolfSSL OpenSSL compatibility builds.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor wolfSSL advisories for an official fix. Until patched, avoid using the PKCS7_verify() compatibility API on untrusted or potentially degenerate PKCS#7 objects. The fix involves rejecting PKCS#7 objects with no valid signer signature regardless of the PKCS7_NOVERIFY flag.