CVE-2025-15346
📋 TL;DR
This vulnerability in wolfssl-py allows attackers to bypass mutual TLS (mTLS) client authentication by omitting client certificates during TLS handshakes. It affects Python applications using wolfssl-py for mTLS authentication with verify_mode=CERT_REQUIRED. Systems relying on client certificates for authentication are vulnerable to unauthorized access.
💻 Affected Systems
- wolfssl-py (wolfSSL Python bindings)
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to protected systems and data by bypassing mTLS authentication entirely.
Likely Case
Unauthorized access to APIs or services protected by mTLS client authentication.
If Mitigated
Limited impact if additional authentication layers or network segmentation exist.
🎯 Exploit Status
Exploitation requires network access to vulnerable service but no authentication or special tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.8.4-stable
Vendor Advisory: https://github.com/wolfSSL/wolfssl-py/releases/tag/v5.8.4-stable
Restart Required: Yes
Instructions:
1. Update wolfssl-py: pip install wolfssl-py==5.8.4
2. Restart all Python applications using wolfssl-py
3. Verify verify_mode=CERT_REQUIRED now properly enforces client certificates
🔧 Temporary Workarounds
Implement certificate validation at application layer
allAdd manual certificate verification in application code after TLS handshake
🧯 If You Can't Patch
- Implement network-level controls to restrict access to vulnerable services
- Add additional authentication layers (API keys, OAuth tokens) alongside mTLS
🔍 How to Verify
Check if Vulnerable:
Check if using wolfssl-py <=5.8.2 with verify_mode=CERT_REQUIRED in TLS configurationCheck Version:
pip show wolfssl-py | grep VersionVerify Fix Applied:
Test mTLS connections without client certificate - should be rejected after patch📡 Detection & Monitoring
Log Indicators:
- Successful TLS connections without client certificates in mTLS-protected services
- Authentication logs showing access without expected certificate validation
Network Indicators:
- TLS handshakes completing without client certificate exchange
- Unauthorized access patterns to mTLS-protected endpoints
SIEM Query:
source="application_logs" AND ("TLS handshake completed" OR "connection established") AND NOT "client certificate verified" AND destination_port IN (443, 8443, other_mTLS_ports)