The vulnerability arises because the MatchTrustedPeer function in wolfSSL ignores the public key during certificate verification, enabling attackers to create forged CA clones that pass verification checks. This affects any build enabling the WOLFSSL_TRUST_PEER_CERT macro and loading CA certificates with wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). If OPENSSL_COMPATIBLE_DEFAULTS is also defined, the affected scope expands to all CA certificate loading. The attacker must know the trusted CA certificates loaded by the peer to exploit this flaw. This allows a malicious (D)TLS server or client to bypass authentication, including in mutual authentication scenarios. The vulnerability is relevant for autoconf builds such as nginx, haproxy, stunnel, wpas, apache httpd, hitch, bind, rsyslog, ffmpeg, and various distributions. Users should update to the latest wolfSSL version, apply the patch, or disable OpenSSL compatible defaults and avoid using the affected APIs to mitigate the issue.

An attacker who knows the trusted CA certificates loaded by a peer can create forged CA clones that bypass certificate verification, allowing them to impersonate trusted servers or clients in (D)TLS connections. This compromises the integrity of authentication and can lead to unauthorized access or man-in-the-middle attacks. The impact is significant in environments relying on mutual authentication or where the trusted CA certificates are known to the attacker.

Users should update to the latest wolfSSL version that includes the fix for this vulnerability or apply the official patch if available. Alternatively, users can mitigate the issue by configuring wolfSSL with the --disable-openssl-compatible-defaults flag and avoiding loading CA certificates using wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). These mitigations prevent the vulnerability from being exploitable. Patch status is not explicitly confirmed in the provided data; users should consult the vendor advisory for the latest remediation guidance.