CVE-2021-45079: In strongSwan before 5.9.5, a malicious responder can send an EAP-Succ ...

Severity: Critical

CVSS Score: 9.1

In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.