CVE-2026-5466: 
wolfSSL vulnerability analysis and mitigation

CVE-2026-5466 is an improper cryptographic signature verification vulnerability in wolfSSL's ECCSI implementation that allows an attacker to forge signatures without possessing any private key. The flaw resides in the wc_VerifyEccsiHash function, which decodes the r and s scalars from a signature blob via mp_read_unsigned_bin without validating that they fall within the required range [1, q-1]. All wolfSSL versions prior to 5.9.1 are affected. It was disclosed on April 10, 2026, and carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.6 (High) (GitHub Advisory, wolfSSL PR #10102).

The root cause is classified as CWE-347 (Improper Verification of Cryptographic Signature). In wc_VerifyEccsiHash, after reading the r and s scalars from the signature buffer, no range check is performed to ensure they lie in [1, q-1]. With s=0, the scalar multiplication [s](...) yields the point at infinity (where J_x=0); with r=0, the final mp_cmp(0, 0) == MP_EQ comparison then unconditionally accepts the forged signature against any message and any identity using only publicly-known constants. The fix, merged in wolfSSL PR #10102, adds [1, q-1] range checks for both r (in wc_VerifyEccsiHash after params are loaded) and s (in eccsi_calc_j after eccsi_decode_sig_s), and adds a defense-in-depth point-at-infinity guard on J before the final comparison. The attack vector is adjacent network with no privileges or user interaction required, though attack requirements (specific deployment conditions) must be present (wolfSSL PR #10102, GitHub Advisory).

Successful exploitation completely breaks authentication integrity for any system relying on wolfSSL's ECCSI signature verification. An attacker can forge a valid-appearing ECCSI signature for any message and any identity without possessing the corresponding private key, effectively impersonating any authenticated entity. This results in high confidentiality and integrity impact — unauthorized access to protected resources and the ability to inject or authorize arbitrary data — with no availability impact. Systems using ECCSI-based authentication or authorization (e.g., identity-based cryptography in IoT, telecommunications, or secure messaging) are at risk of full authentication bypass (GitHub Advisory, wolfSSL PR #10102).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability was reported by Nicholas Carlini (Anthropic) and Bronson Yen (Calif.io) as part of a coordinated vulnerability disclosure effort. The EPSS score is approximately 0.011% (1st percentile), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability is not listed in CISA KEV and no threat actor attribution has been made.

1. Identify target: Locate a system or service that uses wolfSSL versions prior to 5.9.1 with ECCSI-based signature verification enabled (e.g., identity-based authentication in IoT or telecom protocols).
2. Craft forged signature: Construct a signature blob where both r and s scalars are set to zero (or another out-of-range value). No private key material is required — only publicly-known system parameters.
3. Submit forged signature: Send the crafted signature to the target system's ECCSI verification endpoint or protocol handler, presenting it as a valid signature for any chosen message and any claimed identity.
4. Bypass authentication: Because wc_VerifyEccsiHash performs no range check on r and s, the scalar multiplication with s=0 returns the point at infinity (J_x=0), and the final mp_cmp(0, 0) == MP_EQ check accepts the forged signature unconditionally.
5. Achieve objective: The attacker is now authenticated as any identity of their choosing, gaining unauthorized access to resources, sessions, or data protected by ECCSI-based authentication (wolfSSL PR #10102).

Update wolfSSL to version 5.9.1 or later, which includes the fix merged via PR #10102 on April 6, 2026. The patch adds mandatory [1, q-1] range validation for both r and s scalars in wc_VerifyEccsiHash and eccsi_calc_j, and adds a point-at-infinity guard before the final comparison. No configuration-based workaround is available; patching is the only effective remediation. Organizations should audit all applications and embedded systems using wolfSSL prior to 5.9.1 and prioritize upgrading, particularly those using ECCSI-based identity authentication (wolfSSL PR #10102, GitHub Advisory).

The vulnerability was discovered and reported by Nicholas Carlini (Anthropic) and Bronson Yen (Calif.io) as part of a broader coordinated disclosure that also identified several other wolfSSL cryptographic flaws in the same pull request (including CMAC forgery, ChaCha20-Poly1305 tag bypass, and X.509 CA:FALSE bypass). The VulnCheck blog noted these CVEs were credited to Anthropic researchers, highlighting the growing role of AI safety organizations in traditional security research (VulnCheck Blog). The disclosure was also discussed on the oss-security mailing list (oss-sec).