Weakness · High
CWE-295: Improper Certificate Validation
What it is
The product does not validate, or incorrectly validates, a certificate.
- Severity (our rating)
- High
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Architecture and Design, Implementation
- Exploited in the wild
- 5 known exploited CVEs
What an attacker can do
- Bypass Protection Mechanism (Integrity, Authentication)
- Gain Privileges or Assume Identity (Integrity, Authentication)
How to prevent it
Architecture and Design
- Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
- If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
How to find it
- Automated Static Analysis - Binary or Bytecode. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Bytecode Weakness Analysis - including disassembler + source code weakness analysis Binary Weakness Analysis - including disassembler + source code weakness analysis
- Manual Static Analysis - Binary or Bytecode. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Binary / Bytecode disassembler - then use manual analysis for vulnerabilities & anomalies
- Dynamic Analysis with Automated Results Interpretation. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Web Application Scanner
- Dynamic Analysis with Manual Results Interpretation. According to SOAR, the following detection techniques may be useful: Highly cost effective: Man-in-the-middle attack tool
- Manual Static Analysis - Source Code. According to SOAR, the following detection techniques may be useful: Highly cost effective: Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review (not inspections)
- Automated Static Analysis - Source Code. According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer
- Architecture or Design Review. According to SOAR, the following detection techniques may be useful: Highly cost effective: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
Exploited in the wild: 5 CVEs
Vulnerabilities caused by CWE-295 that attackers have used, from CISA's Known Exploited Vulnerabilities catalog, newest first.
- CVE-2026-85102Check Point Multiple Products Improper Certificate Validation Vulnerability · added September 22, 2026
- CVE-2023-41991Apple Multiple Products Improper Certificate Validation Vulnerability · added September 25, 2023
- CVE-2023-20963Android Framework Privilege Escalation Vulnerability · added April 13, 2023
- CVE-2022-26923Microsoft Active Directory Domain Services Privilege Escalation Vulnerability · added August 18, 2022
- CVE-2020-0601Microsoft Windows CryptoAPI Spoofing Vulnerability · added November 3, 2021
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.