onyx --cves cve-2018-21246

CVE-2018-21246

score: <0.1
cvss: 9.8
epss: 2.7%
published: 2020-06-15
kev added: —
first seen: 2026-10-21

Caddy before 0.10.13 contains an authentication bypass caused by mishandling TLS client authentication due to the absence of StrictHostMatching mode, letting attackers bypass host verification.

Timeline

How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.

2020-06-15 Published
2026-10-21 Tracked by Onyx

Weaknesses

CWE-287

References 2

https://bugs.gentoo.org/715214
https://github.com/caddyserver/caddy/releases/tag/v0.10.13