CVE-2026-5466: WolfSSL Auth Bypass Vulnerability

CVE-2026-5466 Overview

CVE-2026-5466 is a cryptographic signature verification flaw in wolfSSL's Elliptic Curve-based Certificateless Signatures for Identity-based Encryption (ECCSI) implementation. The verifier function wc_VerifyEccsiHash decodes the r and s scalars from a signature blob using mp_read_unsigned_bin without validating that the values lie within the cryptographically required range [1, q-1]. An attacker can forge a signature that verifies against any message for any identity using only publicly-known constants. The flaw is tracked under CWE-347: Improper Verification of Cryptographic Signature and affects the wolfSSL embedded TLS library.

Critical Impact

Forged ECCSI signatures verify as valid against any message and any identity, fully breaking signature authenticity guarantees.

Affected Products

• wolfSSL embedded TLS library (ECCSI signature verification path)
• Applications and devices relying on wolfSSL wc_VerifyEccsiHash for identity-based signature verification
• Embedded and IoT deployments using wolfCrypt ECCSI primitives

Discovery Timeline

• 2026-04-10 - CVE-2026-5466 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2026-5466

Vulnerability Analysis

The Elliptic Curve-based Certificateless Signatures for Identity-based Encryption (ECCSI) scheme, defined in RFC 6507, requires the verifier to reject signature scalars that fall outside the valid range [1, q-1], where q is the curve subgroup order. wolfSSL's wc_VerifyEccsiHash implementation omits this bounds check after decoding signature components with mp_read_unsigned_bin.

This omission breaks a fundamental precondition of the ECCSI verification equation. An adversary can craft signature values that trivially satisfy the verifier's algebraic check regardless of the message content or the claimed signer identity. Because the attack requires only publicly-known curve constants and identity material, no secret key knowledge is required.

The attack vector is Adjacent Network, meaning the attacker must be able to deliver a forged signature to a vulnerable verifier within the same logical network segment or protocol session.

Root Cause

The root cause is missing input validation on cryptographic scalars during signature parsing. mp_read_unsigned_bin converts raw bytes into multi-precision integer form but performs no range or zero-value checks. The verifier proceeds to use these unvalidated scalars in elliptic curve point multiplications, producing a verification equation that an attacker can satisfy with degenerate values.

Attack Vector

An attacker constructs a signature blob containing r and s scalars chosen to bypass the verification equation. The forged signature is then submitted to any application that authenticates messages or identities through wc_VerifyEccsiHash. Because verification succeeds, the attacker can impersonate arbitrary identities and authenticate arbitrary messages, undermining the entire ECCSI authentication model.

No verified public exploit code is currently available. Technical details of the fix are described in the wolfSSL Pull Request #10102, which adds the missing scalar range validation.

Detection Methods for CVE-2026-5466

Indicators of Compromise

• Successful ECCSI signature verifications associated with identities or messages that were never legitimately signed by an authorized signer.
• Signature blobs containing r or s scalar values equal to zero or greater than or equal to the curve subgroup order q.
• Anomalous authentication events on embedded devices using wolfSSL where signing key custody cannot account for the verified message.

Detection Strategies

• Inventory all binaries and firmware images linking against wolfSSL and identify versions predating the fix in PR #10102.
• Instrument or log calls to wc_VerifyEccsiHash to capture scalar values and flag signatures where r or s is zero or out of range.
• Compare verification outcomes against an independent ECCSI verifier that enforces RFC 6507 range checks to detect divergent results.

Monitoring Recommendations

• Audit application logs for authentication anomalies tied to ECCSI-protected protocols, particularly repeated successful verifications from unexpected peers.
• Monitor adjacent network segments hosting wolfSSL-based identity verification endpoints for unsolicited signature submissions.
• Track wolfSSL upstream advisories and version metadata across embedded fleets to confirm patch coverage.

How to Mitigate CVE-2026-5466

Immediate Actions Required

• Upgrade wolfSSL to a release containing the fix from PR #10102 across all affected products and firmware images.
• Identify systems exposing wc_VerifyEccsiHash to untrusted or adjacent-network peers and prioritize them for patching.
• Treat any ECCSI-authenticated decisions made by unpatched verifiers as untrusted until validation is reperformed with a fixed build.

Patch Information

The upstream fix adds explicit range validation on the decoded r and s scalars to ensure each lies within [1, q-1] before the verification equation is evaluated. Apply the patch by upgrading to a wolfSSL release that incorporates Pull Request #10102 and rebuilding dependent applications and firmware.

Workarounds

• Disable ECCSI signature verification code paths if the feature is not required by the application or protocol stack.
• Restrict access to verifier endpoints using network segmentation so that only trusted adjacent peers can submit signatures.
• Layer an additional signature verification mechanism, such as ECDSA over a separately authenticated channel, until the wolfSSL update is deployed.

# Configuration example: rebuild wolfSSL without ECCSI support as a temporary workaround
./configure --disable-eccsi
make && sudo make install