Critical wolfSSL Flaw (CVE-2026-5194) Exposes 5 Billion Devices to Digital ID Forgery A severe vulnerability in the wolfSSL cryptographic library, tracked as CVE-2026-5194, has been discovered, impacting an estimated 5 billion devices across industries, including IoT, smart grids, automotive, aviation, and military systems. The flaw, reported by Nicholas Carlini of Anthropic’s Frontier Red Team, stems from missing checks in wolfSSL’s signature verification functions, allowing attackers to forge digital IDs and bypass authentication. The issue affects multiple signature algorithms ECDSA/ECC, DSA, ML-DSA, ED25519, and ED448 due to insufficient validation of digest sizes and Object Identifiers (OIDs), which are critical for verifying cryptographic signatures. Without these checks, malicious actors can trick devices into trusting fake servers or malicious files, posing a significant supply chain risk. wolfSSL 5.9.1, released on April 8, 2026, patches the vulnerability by enforcing stricter hash and digest size validations. However, concerns remain for legacy and unsupported devices, which may never receive updates, leaving them permanently exposed. Security experts, including William Wright of Closed Door Security, warn that the flaw’s widespread adoption in embedded systems complicates patching efforts, particularly for unmonitored or outdated hardware. The vulnerability has been assigned a high severity score by Red Hat, underscoring its potential for exploitation in critical infrastructure. While the patch is available, the long-term risk persists for devices that rely on older, unmaintained versions of wolfSSL.