CVE-2026-101916High· 7.4▾ Twilight@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enabled in affected configurations. This issue is fixed in version 1.14.5 and 1.13.6.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-101915Low· 3.7@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon
CVE-2026-101914Medium· 6.5@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon
CVE-2021-20327Medium· 6.4A specific version of the Node.js mongodb-client-encryption module does not perform correct validation of the KMS server’s certificate
CVE-2026-84445High· 8.7gRPC-Go is the Go language implementation of gRPC
CVE-2018-0227High· 7.5A vulnerability in the Secure Sockets Layer (SSL) Virtual Private Network (VPN) Client Certificate Authentication feature for Cisco Adaptive Security Appliance (ASA) could allow an unauthenticated, remote attacker to establish an SSL VPN…
CVE-2026-1531High· 8.1A flaw was found in foreman_kubevirt