Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:partial_chain/1} to every verify_peer configuration. The callback returns any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor, and OTP honours that callback over the configured cacerts. hackney_ssl:merge_ssl_opts/3 kept the callback when the caller replaced the trust store with cacerts or cacertfile in ssl_options, so a connection pinned to a private CA still accepted any chain that carried a publicly trusted root.
The hostname check still applies, so the attacker needs a publicly trusted certificate for the pinned hostname.
This issue affects hackney: from 1.24.0 before 4.9.0.
CVE-2026-115929 is a high-severity vulnerability in MongoDB Compass related to improper certificate validation. The issue stems from the use of Electron's TLS root certificate store, which includes recoverable eMudhra intermediate CA certificates. This flaw is addressed by updating to Compass version 1.53.1, which incorporates Electron 44.9.1.
Node.js versions 22.x, 24.x, and 26.x contain a vulnerability in TLS hostname verification where server certificates can be incorrectly validated against a different IP address when the host is specified as a non-canonical IPv4 literal with leading zeros. This occurs because the hostname normalization interprets leading-zero octets as octal, while the OS resolver interprets them as decimal, potentially allowing a server to be authenticated with a certificate for another IP address.
Node.js versions 22.x, 24.x, and 26.x contain a vulnerability in TLS hostname verification where certificates with only a DNS Subject Alternative Name (SAN) can improperly authenticate IP endpoints when clients use non-canonical IPv4 address spellings. This occurs because the function tls.checkServerIdentity() normalizes these IP addresses and matches them against DNS names in the certificate, allowing a certificate with DNS:127.0.0.1 but no IP Address SAN to be accepted for connections to 127.0.0.1. Exploitation requires a trusted CA-issued certificate with a numeric DNS SAN and a platform resolver that accepts non-canonical IP spellings, such as glibc.
Node.js versions 24.22.0 and 26.12.0 contain a vulnerability in TLS hostname verification where certificates without a matching IP address Subject Alternative Name (SAN) can authenticate connections to IPv4 addresses written with non-ASCII characters. This occurs because tls.checkServerIdentity() fails to recognize such hosts as IP addresses, leading to improper validation against DNS names and Common Name fields instead. This flaw is a regression from a previous fix and allows acceptance of certificates with DNS entries like '127.0.0.1' for IP endpoints they were not issued for.
CVE-2026-107685 is a critical vulnerability in the agentjido req_llm library affecting versions from 1.9.0 up to but not including 1.29.0. It involves improper TLS certificate validation in the WebSocket streaming client, allowing an on-path attacker to intercept and modify OpenAI WebSocket sessions, including authorization tokens. The flaw arises because the WebSocket client disables certificate verification by default and does not allow enabling it via caller options. This vulnerability does not affect HTTP streaming or HTTP/2 duplex sessions, which properly verify certificates. The issue is fixed in version 1.29.0.
CVE-2026-114611 is a critical vulnerability in schorschii OCO-Server versions prior to 1.2.3. The Apple MDM enrollment endpoint improperly validates PKCS#7 signatures by disabling certificate chain and trust verification, allowing acceptance of self-signed certificates from attackers. This flaw enables an attacker who knows a registered device's serial number to forge enrollment requests and obtain the victim device's MDM identity certificate and private key. Consequently, the attacker can impersonate the victim device in MDM communications, hijacking device management and disrupting enrollment. The issue is fixed in version 1.2.3.
CVE-2026-106017 is a vulnerability in the OpenVPN 3 Core library versions 3.4 through 3.11.7 where improper certificate validation allows attackers to bypass extended key usage restrictions. This flaw could enable attackers to use certificates in unintended ways, potentially undermining the security of VPN connections. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.3. No public exploits or known active exploitation have been reported. There is no explicit information about available patches in the provided data.
NT OneAPP by NewType Infortech suffers from an improper certificate validation vulnerability (CWE-295). This flaw allows unauthenticated network-adjacent attackers to perform man-in-the-middle attacks by exploiting the application's failure to properly validate server certificates and hostnames. The vulnerability affects versions from 0 up to and including 1.5.22. It has a high severity with a CVSS 4.0 score of 9.3, indicating critical risk. No known exploits are reported in the wild, and no patch information is provided.
CVE-2026-87944 is an improper certificate validation vulnerability in the Drupal SAML SSO - Service Provider module. This flaw affects versions from 0.0.0 up to but not including 3.2.0. The vulnerability could allow an adversary to perform a Man-in-the-Middle (MitM) attack by exploiting the certificate validation weakness. The issue has a medium severity rating with a CVSS score of 4.8. A fix is available in version 3.2.0.
CVE-2026-96375 is an improper certificate validation vulnerability in Drupal Cloud versions prior to 7.0.1. This flaw could allow an adversary to perform a man-in-the-middle attack. The vulnerability has a medium severity rating with a CVSS score of 4.8. A fix is available in version 7.0.1.
Red Hat Enterprise Linux 10's system certificate authority (CA) store included root CA certificates that signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. This weakness could allow a man-in-the-middle attacker to issue certificates for arbitrary host names trusted by clients using the system CA store, potentially redirecting clients to malicious sites. Due to limitations in distrusting specific intermediate certificates, Red Hat is removing the root CA certificates that signed these weak intermediates. Red Hat classifies this issue as a trust store update rather than a vulnerability and has released updated ca-certificates packages to address it.
Apache Traffic Server contains a critical vulnerability (CVE-2026-111815) involving improper certificate validation. The server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's strict verification policy. This flaw affects multiple versions from 8.0.0 through 10.2.0. Fixed versions include 9.2.16, 10.1.5, and 10.2.1.
Apache Traffic Server versions 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0 contain a vulnerability in the default outbound session-sharing policy. This flaw allows reuse of a pooled TLS session authenticated with one client certificate for a transaction that should present a different client certificate. The issue is fixed in versions 9.2.16, 10.1.5, and 10.2.1.