Because the VerifTeeAttestation verifier receives an expected session value but fails to use it when validating the TDX QuoteV4 evidence, it can accept evidence containing mismatched or reused REPORT_DATA. This allows the relying party to release application data or make trust decisions for an unrelated attestation context, which can result in session‑misbinding attacks and potential unauthorized data disclosure.

Ultravioletrs Cocos versions 0.8.2 and earlier are affected. The issue was addressed in release 0.9.0, which implements the missing REPORT_DATA check.

The CVSS score of 9.1 indicates a high severity attack affecting confidentiality and integrity. The EPSS score of less than 1% suggests the current probability of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an attacker to supply a malicious or replayed TDX Quote during a TLS handshake, a scenario that could be performed by an adversary with network or privileged access to the verifying application.