CVE-2026-108362
Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence or extract attestation secrets from a compromised unrevoked platform, the verifier accepts valid measurements from a different unrevoked TEE platform as though they came from the intended Attester. The attacker can impersonate the attested TLS endpoint. This issue is fixed in version 0.11.0.
| CWE | CWE-346 |
| Vendor | privasys |
| Product | ra-tls-clients |
| Published | Oct 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for privasys ra-tls-clients
Be the first to know when new unknown vulnerabilities affecting privasys ra-tls-clients are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Privasys / ra-tls-clients
< 0.11.0