The vulnerability occurs when libcurl is configured with CURLOPT_PINNEDPUBLICKEY together with disabled standard peer verification; under these circumstances the library mistakenly skips public key pinning enforcement, allowing a connection that presents no server certificate to succeed and effectively neutralizing the pinning protection. An attacker could thus trick the client into communicating with a malicious server, enabling man‑in‑the‑middle attacks that compromise confidentiality and integrity.

This defect is present in the libcurl component of the curl project (curl:curl). No specific product versions are listed; all builds containing the affected libcurl code are potentially impacted. The vulnerability is client‑side and any application using libcurl with the offending configuration is susceptible.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no public exploitation at the time of writing. However, the risk materializes only when an application intentionally disables certificate verification, which often indicates insecure or legacy code. In such environments, an attacker can exploit the bypass to establish a forged TLS session. Because the flaw resides in local configuration, it cannot be triggered remotely without compromising the application runtime, so the exploitation likelihood is moderate to high for applications that misuse the verification options. The impact level would be considered high due to potential man‑in‑the‑middle and credential compromise.