Botan CVE-2026-34582

Botan C++ cryptography library versions prior to 3.11.1 with TLS 1.3 enabled. Remote unauthenticated attacker can bypass client certificate authentication by omitting Certificate, CertificateVerify, and Finished messages, sending ApplicationData records instead. Affects servers enforcing mutual TLS authentication.

Real-world risk is HIGH for deployments using Botan TLS 1.3 servers with mandatory client certificate authentication, despite no confirmed active exploitation (CISA KEV not listed). The CVSS 4.0 vector indicates maximum exploitability: network attack vector (AV:N), low complexity (AC:L), no attack requirements (AT:N), no privileges needed (PR:N), and no user interaction (UI:N). High integrity impact (VI:H) directly maps to authentication bypass scenarios where certificate validation is the sole access control mechanism. However, impact is narrowly scoped to TLS 1.3 client-auth deployments specifically - servers using other auth methods (password, token) or TLS 1.2 are unaffected. EPSS data not provided, but the protocol-level nature and GitHub Security Advisory disclosure increase likelihood of proof-of-concept development. SSVC decision factors favor prioritization: exploitation status is public (advisory published), automatable (protocol manipulation tools exist), and technical impact is total for targeted configurations (complete auth bypass). The narrow deployment scope (TLS 1.3 client-auth using Botan) reduces overall exposure compared to more ubiquitous vulnerabilities, but organizations meeting these criteria face critical risk requiring immediate patching.

An attacker targets a Botan-based TLS 1.3 server requiring client certificate authentication for API access. The attacker initiates a TLS 1.3 handshake, completes ServerHello and key exchange, but deliberately omits the Certificate, CertificateVerify, and Finished messages. Instead, the attacker immediately sends ApplicationData records containing API requests. The vulnerable Botan server processes these requests as authenticated traffic despite never validating client credentials, granting the unauthenticated attacker full access to certificate-protected resources. This bypass is network-exploitable with scripted TLS client modifications and requires no legitimate credentials or user interaction.