The flaw exists in the mg_tls_verify_cert_signature function within mongoose.c, part of Cesanta Mongoose’s P‑384 Public Key Handler. A crafted request can manipulate the signature verification logic, allowing an attacker to bypass the certificate validation that is normally performed during TLS handshakes. Because the vulnerability grants authorization bypass, an attacker who exploits it could elevate privileges or gain unauthorized access to protected resources, compromising confidentiality, integrity, or availability of services that rely on proper certificate validation.

Cesanta Mongoose is affected on versions up to 7.20 inclusive. The fix is delivered in release 7.21, which incorporates the commit 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. Systems deploying any earlier build of Mongoose should review their version number and apply the upgrade.

The CVSS base score is 6.3, indicating moderate severity. The EPSS score is unavailable, but the exploitability is described as difficult and the attack can be launched remotely, suggesting limited but non‑negligible risk. Because the vulnerability is not listed in the CISA KEV database, it has not yet been confirmed as a known exploited vulnerability, yet public disclosure may lead to future attacks. Until the product is patched, the window of opportunity remains open for attackers who can target systems that still use Mongoose 7.20 or earlier.