wget2 accepts a server certificate that has an incorrect Key Usage or Extended Key Usage. If an attacker obtains a certificate and private key that were issued for a different purpose, they can reuse that certificate to present themselves as an SSL/TLS server. This undermines the integrity of the TLS trust chain and could enable man‑in‑the‑middle attacks or allow an attacker to impersonate a legitimate service. The weakness is an input validation flaw (CWE‑20).

The vulnerability affects GNU wget2. No specific version information was provided in the advisory, so all releases prior to a fixed version are potentially affected. Refer to the GNU wget2 project for an official update timeline.

The CVSS base score is 4.8, indicating moderate severity. The EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote: any client using wget2 to connect to an HTTPS endpoint could be tricked into accepting a malicious certificate. An attacker controlling a certificate issued for another purpose must compromise its private key, but once that key is in hand, they can present the certificate during the TLS handshake with wget2, bypassing usual Key Usage or EKU checks.