← Back

CVE-2026-78135

nvd nist
Published: Sep 11, 2026Modified: Sep 16, 2026

JSON object

Loading...
7.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Exploitability: 3.9 / Impact: 3.4
Source: NVD

Description

libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass.

Affected (1)

Strongswan
1 product
Strongswan
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Strongswan
5.9.7 ≤ version ≤ 6.0.7

Related CWEs

CWE-841
Improper Enforcement of Behavioral Workflow
The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

References (2)

Source: cve@mitre.org
Release NotesVendor Advisory
Source: cve@mitre.org
Vendor AdvisoryMitigation

Timeline

No history available yet.