Botan’s Certificate_Store::certificate_known function returns true when a certificate’s distinguished name (DN) and optional subject key identifier match any certificate already in the trusted store, but it does not verify that the matched certificate is the exact same instance. When the path‑validation logic was extended in version 3.11.0, it incorrectly assumed that certificate_known only confirmed identity. As a result, an end‑entity certificate with the same DN (and subject key identifier, if any) as a trusted root is accepted immediately as a trusted root. This bypassing of trust chain validation permits an attacker to present a forged or malicious certificate to an application that uses Botan 3.11.0, effectively granting the attacker the same privileges as a root certificate authority. The weakness is classified as CWE‑295, Authentication Bypass via Certificate Trust.

Systems that incorporate the randombit Botan cryptographic library, specifically version 3.11.0. Applications built against Botan 3.11.0 for TLS, SSL, or other cryptographic operations are vulnerable. The issue has been fixed in Botan 3.11.1, so any deployment using an older 3.11.0 build is at risk.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. Although EPSS data is not provided, the lack of a KEV listing suggests no widespread exploitation yet. An attacker would need to supply a certificate that shares the distinguished name, and optionally the subject key identifier, of an existing trusted root. When such a certificate is presented to a Botan 3.11.0 application—for example, during a TLS handshake or client‑certificate authentication—the library mistakenly accepts it as a self‑trusted root. The resulting compromise allows the attacker to present forged certificates, intercept or alter secure communications, and potentially elevate privileges. The library’s internal assumption called out by CWEs: Authentication Bypass via Trust Anchor.