CVE-2026-33753

rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161. Prior to 1.0.6, an Authorization Bypass vulnerability in rfc3161-client's signature verification allows any attacker to impersonate a trusted TimeStamping Authority (TSA). By exploiting a logic flaw in how the library extracts the leaf certificate from an unordered PKCS#7 bag of certificates, an attacker can append a spoofed certificate matching the target common_name and Extended Key Usage (EKU) requirements. This tricks the library into verifying these authorization rules against the forged certificate while validating the cryptographic signature against an actual trusted TSA (such as FreeTSA), thereby bypassing the intended TSA authorization pinning entirely. This vulnerability is fixed in 1.0.6.

• CWE-295

• https://github.com/trailofbits/rfc3161-client/security/advisories/GHSA-3xxc-pwj6-jgrjExploit, Vendor Advisory
• https://github.com/trailofbits/rfc3161-client/security/advisories/GHSA-3xxc-pwj6-jgrjExploit, Vendor Advisory

Published

Apr 8, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33748BuildKit is a toolkit for converting source code to build ar…7.5
• CVE-2026-33749n8n is an open source workflow automation platform. Prior to…9
• CVE-2026-3375The LiteSpeed Cache plugin for WordPress is vulnerable to St…7.2
• CVE-2026-33750The brace-expansion library generates arbitrary strings cont…7.5
• CVE-2026-33751n8n is an open source workflow automation platform. Prior to…4.8
• CVE-2026-33752curl_cffi is the a Python binding for curl. Prior to 0.15.0,…8.6
• CVE-2026-33754Wazuh is a free and open source platform used for threat pre…6.5
• CVE-2026-33755Group-Office is an enterprise customer relationship manageme…8.8
• CVE-2026-33756Saleor is an e-commerce platform. From 2.0.0 to before 3.23.…7.5
• CVE-2026-33757OpenBao is an open source identity-based secrets management …8.3
• CVE-2026-33758OpenBao is an open source identity-based secrets management …6.1
• CVE-2026-33759WWBN AVideo is an open source video platform. In versions up…5.3