CWE-599 13 CVEs MITRE definition ↗

CWE-599: Missing Validation of OpenSSL Certificate

Overview

CWE-599 (Missing Validation of OpenSSL Certificate) documents a weakness type used across vulnerability databases and security assessments. Use the sections below for definition, context, and mapped CVEs.

Security impact
Security impact: Depends on product and context; use CVE records, severity scores, and MITRE guidance to prioritize.

Description

The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.

Applicable platforms

Kind Name Class Prevalence OS / CPE
language Not Language-Specific Undetermined

Related CVEs in this database

These CVEs are mapped to this weakness in this database and kept for traceability and search.

CVE Published Summary
CVE-2026-25060 2026-02-02 OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default t…
CVE-2025-63432 2025-11-24 Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is Missing SSL Certificate Validation. The application fails to properly validate the TLS certificate from its update server. An attacker …
CVE-2025-56232 2025-11-05 GOG Galaxy 2.0.0.2 suffers from Missing SSL Certificate Validation. An attacker who controls the local network, DNS, or a proxy can perform a man-in-the-middle (MitM) attack to intercept update reques…
CVE-2025-56230 2025-11-04 Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component.
CVE-2025-12553 2025-10-31 Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-56146 2025-09-23 Indian Bank IndSMART Android App 3.8.1 is vulnerable to Missing SSL Certificate Validation in NuWebViewActivity.
CVE-2024-41265 2024-08-01 A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.
CVE-2024-41253 2024-07-31 goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component.
CVE-2024-40464 2024-07-31 An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file
CVE-2024-36755 2024-06-27 D-Link DIR-1950 up to v1.11B03 does not validate SSL certificates when requesting the latest firmware version and downloading URL. This can allow attackers to downgrade the firmware version or change …
CVE-2023-48052 2023-11-16 Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
CVE-2022-31105 2022-07-12 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation …
CVE-2021-21374 2021-03-26 Nimble is a package manager for the Nim programming language. In Nim release versions before versions 1.2.10 and 1.4.4, "nimble refresh" fetches a list of Nimble packages over HTTPS without full verif…

Previous names

  • No OpenSSL Certificate Check Performed before Use (2008-04-11)
  • Trust of OpenSSL Certificate Without Validation (2013-02-21)

Content submission

Name
CWE Community
Date
2006-12-15
Version
Draft 5
Comment
Submitted by members of the CWE community to extend early CWE versions

Content modifications

Date Name Version Importance Comment
2008-07-01 Eric Dalci 1.0 updated Time_of_Introduction
2008-09-08 CWE Content Team 1.0 updated Common_Consequences, Relationships, Other_Notes
2009-03-10 CWE Content Team 1.3 updated Relationships
2009-07-27 CWE Content Team 1.5 updated Relationships
2010-12-13 CWE Content Team 1.11 updated Description
2011-06-01 CWE Content Team 1.13 updated Common_Consequences, Other_Notes
2012-05-11 CWE Content Team 2.2 updated Relationships
2013-02-21 CWE Content Team 2.4 updated Demonstrative_Examples, Description, Name, Relationship_Notes, Relationships
2014-07-30 CWE Content Team 2.8 updated Relationships
2017-11-08 CWE Content Team 3.0 updated Modes_of_Introduction, Relationships
2019-09-19 CWE Content Team 3.4 updated Demonstrative_Examples
2020-02-24 CWE Content Team 4.0 updated Relationships
2023-01-31 CWE Content Team 4.10 updated Description
2023-04-27 CWE Content Team 4.11 updated Modes_of_Introduction, Relationships, Time_of_Introduction
2023-06-29 CWE Content Team 4.12 updated Mapping_Notes
2025-12-11 CWE Content Team 4.19 updated Applicable_Platforms, Weakness_Ordinalities
2026-04-30 CWE Content Team 4.20 updated Common_Consequences, Description, Diagram
cvelogic Threat Intelligence