Auth bypass in Wolfssl
CVE-2026-55962
TLS 1.3 post-handshake authentication (PHA) issue where a server could accept a client's Finished message without the client having sent a Certificate and CertificateVerify. The post-handshake-auth exemption that allows an empty/absent pee…
Vulnerability class: Broken Authentication
Affected products
- Wolfssl — versions 5.5.4