Jwt Attack EUVD-2026-18021

Remote unauthenticated attacker exploiting Mbed TLS 3.5.x or 3.6.0-3.6.5, or TF-PSA-Crypto 1.0 when using finite-field Diffie-Hellman (FFDH) key exchange. Requires either peer relationship or man-in-the-middle network position. Only affects protocols depending on contributory behavior (TLS unaffected).

The risk profile for this vulnerability is nuanced and context-dependent. With no CVSS score, EPSS data, or public exploit code provided, the severity cannot be quantified through standard metrics. However, the vulnerability has clear cryptographic implications: it violates a fundamental security property (contributory behavior) in FFDH implementations. The impact is moderate in scope because TLS itself does not depend on this property and is therefore unaffected. The real risk lies in non-TLS protocols or custom implementations that rely on FFDH for contributory behavior-these face high cryptographic risk if they use the affected library versions. The attack vector includes both direct peer-driven exploitation (requiring the attacker to participate in the key exchange) and active network interception (MITM). Organizations using Mbed TLS or TF-PSA-Crypto primarily for TLS can deprioritize patching; those using these libraries for custom FFDH-based protocols must prioritize remediation. The absence of public exploit code and KEV status suggests this is not a widespread active threat, but the cryptographic nature of the flaw warrants prompt attention from affected protocol designers and implementers.

In a protocol requiring contributory behavior (such as a custom protocol deriving session keys from FFDH shared secrets), an attacker who participates in the key exchange can supply a maliciously crafted Diffie-Hellman prime or other parameters that force the peer's shared secret computation into a small set of values. For example, if the attacker provides parameters with known small subgroup structure, the resulting shared secret becomes predictable despite cryptographically valid modular arithmetic. An active network attacker (MITM) can exploit this further by intercepting and modifying the peer's parameters in transit. No public proof-of-concept exploit code is currently available, and exploitation requires either direct peer participation or network-level interception capability.