🎯 New Report #3558277: Fail-Open in set tlsext servername callback on pyopenssl via unhandled exceptions leads to security bypass
🔺Severity: Low
👽 Reporter: uv3doble
⭐️ Reputation: 154
🛠 State: resolved
💼 Team: Python Cryptographic Authority
💵 Bounty: null
🕐 Submitted: 2026-02-16
⏰ Disclosed: 2026-03-20 16:10:03
📝 Summary: A vulnerability was discovered in the pyopenssl library's handling of the Server Name Indication (SNI) callback (set tlsext servername callback). The internal wrapper for this callback catches all Python exceptions raised by user code but returns 0 (Success/SSL TLSEXT ERR OK) to the underlying OpenSSL engine. This behavior allowed a TLS connection to be successfully established even when the security validation logic inside the callback crashed or raised an exception, potentially bypassing critical access controls or authentication mechanisms implemented at the SNI layer.
📂 Report JSON File: 3558277
@hackeronereports