The vulnerability allows an attacker to poison the client session cache so that a TLS session can be resumed using a session ID belonging to a different server. When this occurs the abbreviated handshake omits the Certificate message, meaning neither certificate validation nor domain name checking is performed. As a result the attacker is accepted as the original server, enabling credential theft, data tampering, or other malicious actions without the client noticing. This flaw is a weakness in authentication (CWE‑287).

The flaw is present in wolfSSL builds that do not define the NO_SESSION_CACHE_REF, NO_SESSION_CACHE, NO_CLIENT_CACHE or TITAN_SESSION_CACHE options. Versions from 5.3.0 through 5.9.2 are affected. The issue can appear in default builds or in configurations that enable OpenSSL compatibility or the standard testing suites; builds that explicitly enable flags such as --enable-all, --enable-distro, --enable-curl, --enable-nginx, --enable-haproxy, --enable-stunnel, --enable-wpas or the OPENSSL_COMPATIBLE_DEFAULTS family avoid the bug.

The CVSS score is 2.3, indicating a low overall severity, and no EPSS data is available. The flaw is not listed in CISA’s KEV catalog. The attack vector requires the attacker to control or manipulate a TLS session ID that the client will cache during an earlier handshake, and it may be conducted over the network or via an application that shares the process global cache. Because the poisoned cache entry persists until evicted or timed out (by default 500 seconds), a vulnerable client may continue to accept the malicious server for a short period of time. While exploitation is limited by the need to supply a session ID that already exists in the cache, remote attackers could trigger the cache overwrite by establishing an initial connection to a legitimate server and then presenting a forged session ID from a malicious server in a second connection. The use of the global cache allows the poisoned entry to cross WOLFSSL_CTX boundaries, extending the window in which the impersonation can occur.