The vulnerability allows a TLS or DTLS client to accept an unsolicited server certificate of type RawPublicKey (server_cert_type=RawPublicKey). If the client build has Raw Public Key (RPK) support enabled, the client will trust the server’s certificate without performing the usual authentication checks. This lets an attacker or misbehaving server bypass authentication and potentially conduct a man‑in‑the‑middle or unauthorized access attack. The weakness is tied to CWE‑287, improper authentication.

The affected vendor is wolfSSL. The flaw resides in the wolfSSL client code and applies to any wolfSSL TLS 1.2, 1.3 or DTLS 1.2 implementation that has RPK enabled. RPK is a compile‑time option enabled by --enable-rpk, --enable-all, or --enable-distro; builds without RPK are not impacted.

The flaw carries a CVSS score of 8.3, indicating high severity. The EPSS score is not available, so it cannot be quantified at this time, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a direct TLS/DTLS connection to a server that advertises a RawPublicKey certificate. An attacker would need to configure the server to supply such a certificate and then connect to the vulnerable client. Without RPK enabled, the risk is eliminated. If RPK is active, the client will accept any RawPublicKey certificate, enabling authentication bypass.