CVE-2026-118768

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocsp_check command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a matching and timely GOOD response with an empty, invalid, or unauthorized signature, causing a revoked certificate to produce exit status 0 and OCSP check OK output. Only the command-line interface is affected. This issue is fixed in version 3.13.0.

• CWE-347

• https://github.com/randombit/botan/commit/46b2a9ca59b0797184fbf7537495bda6e61a1983
• https://github.com/randombit/botan/pull/5825
• https://github.com/randombit/botan/security/advisories/GHSA-mpr7-9494-4qcw

Published

Oct 29, 2026

Last Modified

Oct 30, 2026

Status

Awaiting Analysis

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-118762Monkeytype is a minimalistic and customizable typing test. P…9.3
• CVE-2026-118763sigstore-js provides JavaScript libraries for interacting wi…7.4
• CVE-2026-118764minimatch is a minimal matching utility for converting glob …6.9
• CVE-2026-118765Botan is a C++ cryptography library. From 3.7.0 until 3.13.0…7.3
• CVE-2026-118766Botan is a C++ cryptography library. Prior to 3.13.0, Botan'…6.1
• CVE-2026-118767Botan is a C++ cryptography library. From 1.11.22 until 3.13…4.8
• CVE-2026-118769Botan is a C++ cryptography library. From 2.1.0 until 3.13.0…9.2
• CVE-2026-11877An unauthorized user can modify configuration through API ca…7.5
• CVE-2026-118772joi is a schema description language and data validator for …7.5
• CVE-2026-118773Glob matches files using patterns the shell uses. From 9.0.0…6.3
• CVE-2026-118774Forge (also called node-forge) is a native implementation of…3.7
• CVE-2026-118775Forge (also called node-forge) is a native implementation of…3.7