Vulnerabilities in Intra-Handshaking Attestation Expose Relay Attack Risks

• •Intra-handshake attestation mechanisms are vulnerable to relay attacks.
• •CVE-2026-33697 has been assigned with a CVSS score of 7.5.
• •Developers are advised not to use current proof-of-concept implementations due to high-severity risks.

Recent research has revealed significant vulnerabilities in intra-handshake attestation mechanisms used in attested TLS protocols. The formal analysis conducted by researchers, including Muhammad Usama Sardar, utilized the ProVerif tool to demonstrate that all candidate binding mechanisms are insecure, leading to potential relay attacks where an attacker can mislead a client into accepting evidence from a different server. This vulnerability has been assigned CVE-2026-33697 with a CVSS score of 7.5. The researchers disclosed these findings responsibly to vendors, resulting in a security advisory. The study indicates that achieving strong application-traffic binding using intra-handshake attestation alone may not be feasible. Developers are strongly advised against using the current proof-of-concept implementations due to these high-severity vulnerabilities. Further investigations are ongoing to uncover additional vulnerabilities in this area.