CVE-2026-108362 Details

A vulnerability in Privasys Remote Attestation TLS Clients prior to version 0.11.0 allows a network attacker to impersonate an attested TLS endpoint. This occurs because the software accepts TEE attestation evidence without requiring an explicitly authorized platform identity. If an attacker can forge evidence or extract attestation secrets from a compromised, unrevoked platform, they can exploit this flaw. The vulnerability arises from Privasys accepting any valid attestation evidence, regardless of the platform it originated from, leading to potential impersonation of the intended Attester.

Users can upgrade to Privasys Remote Attestation TLS Clients version 0.11.0 or later, which implements a platform identity verification mechanism. This version allows users to specify which platforms' evidence is accepted, ensuring that only authorized identities can be validated.