CVE-2026-45389 Auth bypass in n/a
Insufficient certificate checks in OCaml-TLS allow client impersonation when client authentication is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-45389?
CVE-2026-45389 is a high-severity authentication bypass vulnerability in n/a, published on 15 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate provided by the client (when doing client authentication), which allows impersonation with certificates that are not meant for client authentication (because of KeyUsage and ExtendedKeyUsage).
Weakness: CWE-295
Which versions are affected by CVE-2026-45389?
How do I fix CVE-2026-45389?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-45389 being exploited?
There is no known exploitation of CVE-2026-45389 in the wild and no public exploit code.
Sources
Also known as GHSA-8wf9-g5q8-gg97, OSEC-2026-07.