PT-2026-53644 · Pypi · Wolfssl

Published 2026-06-29 · Updated 2026-06-29

OSV

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

A vulnerability in the handling of verify mode = CERT REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be fully enforced. 

Because the WOLFSSL VERIFY FAIL IF NO PEER CERT flag was not included, the behavior effectively matched CERT OPTIONAL: a peer certificate was verified if presented, but connections were incorrectly authenticated when no client certificate was provided. 

This results in improper authentication, allowing attackers to bypass mutual TLS (mTLS) client authentication by omitting a client certificate during the TLS handshake. 

The issue affects versions up to and including 5.8.2.

Fix

Related Identifiers

PYSEC-2026-575

Affected Products

Wolfssl

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-15346 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-575 · Vendor Advisory
• https://github.com/wolfSSL/wolfssl-py/pull/62 · Note
• https://github.com/wolfSSL/wolfssl-py/commit/b4517dece79f682a8f453abce5cfc0b81bae769d · Note
• https://github.com/wolfSSL/wolfssl-py/releases/tag/v5.8.4-stable · Note
• https://github.com/wolfSSL/wolfssl-py · Note
• https://github.com/advisories/GHSA-vj87-jj27-4h9c · Note
• https://pypi.org/project/wolfssl · Note