N A CVE-2026-34873

Requires Mbed TLS versions 3.5.0 through 4.0.0 with TLS 1.3 session resumption enabled. Remote unauthenticated attacker can impersonate a client during session resumption. No victim interaction needed.

Risk assessment is constrained by missing CVSS and EPSS data; however, the attack vector is network-based (TLS protocol-level), likely with low complexity given the session resumption context is a standard protocol flow. Client impersonation in TLS is a critical authentication bypass that undermines the entire security posture of TLS-protected communications. The information disclosure tag suggests data exposure is possible once impersonation succeeds. Without CVSS or KEV confirmation, the real-world exploitation likelihood cannot be quantified, but the nature of the flaw (authentication bypass in session handling) and its scope across two major version ranges (3.5.0-4.0.0) indicate this warrants urgent patching. The absence of publicly disclosed EPSS or CVE.org details suggests this may be a recently disclosed vulnerability with limited visibility; organizations using affected Mbed TLS versions for TLS termination should treat this as a high priority.

An attacker positioned on the network (man-in-the-middle or on a shared network segment) intercepts or forges a TLS 1.3 session ticket from a legitimate client-server pair. When the client later attempts to resume the session using the session ticket, the attacker replays or crafts a malicious ticket that the server accepts due to insufficient validation, allowing the attacker to assume the client's identity and access server resources or read encrypted data intended for the legitimate client. No public proof-of-concept or active exploitation confirmation is available at time of analysis.