The vulnerability causes the cpp‑httplib library to skip certificate chain validation when connecting to an IP literal host. An attacker positioned between the client and server can supply a forged certificate and read or modify HTTPS traffic, thereby compromising confidentiality and integrity. The weakness is an improper handling of TLS certificate verification for IP addresses and is classified as CWE‑295.

Affected versions include yhirose:cpp-httplib with the Mbed TLS backend from versions 0.31.0 through 0.46.1 and the wolfSSL backend from versions 0.33.0 through 0.46.1. All releases newer than 0.47.0 contain the fix.

The CVSS score of 7.4 marks the flaw as high severity. The EPSS score of less than 1% indicates a very low but non‑zero probability of exploitation, and the vulnerability is not listed in CISA KEV. Exploitation requires an active man‑in‑the‑middle attack between the client and server and the use of an IP‑literal host; the bypass applies only to HTTPS connections that use a direct IP address, which limits its exposure. Systems still running affected library versions remain vulnerable until the recommended update is applied.