CVE-2026-45389: OCaml-TLS Auth Bypass Vulnerability

CVE-2026-45389 Overview

CVE-2026-45389 is an improper certificate validation flaw [CWE-295] in the OCaml-TLS library before version 2.1.0. The server-side implementation performs insufficient checks on certificates presented by clients during mutual TLS authentication. Specifically, the server fails to verify the KeyUsage and ExtendedKeyUsage extensions of the client certificate. An attacker holding a certificate not intended for client authentication can impersonate a legitimate client. This affects confidentiality and integrity of authenticated TLS sessions in any service relying on OCaml-TLS for mutual authentication.

Critical Impact
Attackers can impersonate authenticated clients by presenting certificates that should not be accepted for client authentication, bypassing mutual TLS protections.

Affected Products

OCaml-TLS library versions prior to 2.1.0
Server applications using OCaml-TLS for client certificate authentication
OCaml ecosystem services relying on mutual TLS via OCaml-TLS

Discovery Timeline

2026-06-15 - CVE-2026-45389 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-45389

Vulnerability Analysis

The vulnerability resides in the OCaml-TLS server logic responsible for validating client certificates during the TLS handshake. When a server requests client authentication, the client returns a certificate chain. The server must verify that the leaf certificate is authorized for the clientAuth purpose. OCaml-TLS before 2.1.0 omits the required checks against the X.509 KeyUsage and ExtendedKeyUsage extensions. As a result, certificates issued for unrelated purposes such as serverAuth, code signing, or email protection can satisfy the handshake. The flaw maps to [CWE-295] Improper Certificate Validation. Refer to the OSV Vulnerability Report OSEC-2026-07 for additional technical context.

Root Cause

The library skips enforcement of certificate purpose constraints defined in RFC 5280. The KeyUsage extension restricts the cryptographic operations a key may perform, while ExtendedKeyUsage declares the application purposes a certificate is valid for. By not validating these extensions, OCaml-TLS treats any chain-valid certificate as acceptable for client authentication.

Attack Vector

An attacker needs network access to a server that performs client authentication using OCaml-TLS. The attacker must also possess any certificate signed by a certificate authority the server trusts. This includes server certificates, code-signing certificates, or S/MIME certificates issued from the same trust anchor. The attacker then completes the TLS handshake and impersonates a legitimate authenticated client. Attack complexity is elevated because the attacker must obtain a chain-valid certificate from a trusted CA.

No verified proof-of-concept code is publicly available. The vulnerability manifests during X.509 extension validation in the handshake path; see the linked OSV advisory for the upstream fix details.

Detection Methods for CVE-2026-45389

Indicators of Compromise

Successful mutual TLS handshakes where the presented client certificate lacks the clientAuth value in its ExtendedKeyUsage extension.
Authenticated sessions originating from certificates whose KeyUsage extension does not include digitalSignature or keyAgreement.
Audit log entries showing client certificate serial numbers or subjects that do not correspond to provisioned client identities.

Detection Strategies

Parse server-side TLS access logs and extract the ExtendedKeyUsage OIDs of accepted client certificates. Flag any session where 1.3.6.1.5.5.7.3.2 is absent.
Compare authenticated client certificate fingerprints against an allowlist of provisioned client identities and alert on mismatches.
Inspect packet captures of TLS handshakes and decode the Certificate message to validate extension contents independently of the application.

Monitoring Recommendations

Forward TLS authentication events into a centralized data lake or SIEM for correlation across services that use OCaml-TLS.
Alert on first-seen certificate subjects or issuers presented to mTLS endpoints.
Track upstream OCaml-TLS release advisories and dependency manifests for services still pinned below 2.1.0.

How to Mitigate CVE-2026-45389

Immediate Actions Required

Upgrade OCaml-TLS to version 2.1.0 or later in all affected services and rebuild dependent applications.
Inventory OCaml services performing client certificate authentication and prioritize internet-facing endpoints.
Rotate or revoke any client certificates whose use cannot be audited, and review CA-issued certificates trusted by mTLS endpoints.

Patch Information

The issue is fixed in OCaml-TLS 2.1.0. The release adds enforcement of KeyUsage and ExtendedKeyUsage validation for client certificates during server-side authentication. See the OSV Vulnerability Report OSEC-2026-07 for upstream patch references.

Workarounds

Restrict the set of trusted certificate authorities for mTLS endpoints to a dedicated CA that issues only client authentication certificates.
Place an external TLS terminator that performs strict ExtendedKeyUsage validation in front of OCaml-TLS servers until the library upgrade is deployed.
Implement application-layer checks that match the presented certificate fingerprint against an allowlist of provisioned clients.

bash

# Example: verify a client certificate has clientAuth EKU before trusting it
openssl x509 -in client.pem -noout -ext extendedKeyUsage \
  | grep -q 'TLS Web Client Authentication' \
  && echo "clientAuth present" \
  || echo "REJECT: certificate not valid for client authentication"