地图 / TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections

TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections

密码学缺陷 / Exploiting Incorrectly Configured SSL/TLS / #3649802

厂商: Node.js
严重程度: 低危 · CVSS 4.3
赏金: —
弱点: Exploiting Incorrectly Configured SSL/TLS
研究员: @3d7omb
披露日期: 2026-06-25
资产: https://github.com/nodejs/node
CVE: CVE-2026-48934

该报告还没有中文解读。

时间线

2026-04-04报告提交
2026-06-25公开披露

阅读 HackerOne 原文 ↗作者 @3d7omb · 版权归作者与 Node.js 所有

同类报告

HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934)Node.js · 2026-07-30

TLS host identity verification bypass via session reuse with different servername leads to unauthorized connections · 破甲 POJIA