CVE-2026-115529: Schannel TLS auto client session resumption

How it was found

Summary:

In curl 8.23.0 with Schannel, TLS session resumption preserves an authenticated client certificate identity across a cross-origin redirect even after automatic client certificate selection is disabled.

This appears to be an incomplete fix for CVE-2026-86415, where the original fix addressed authenticated connection reuse but did not prevent the same authentication state from being retained through TLS session resumption.

Affected version

Reproduced with libcurl 8.23.0-DEV (Schannel) on a Windows Server 2022 GitHub Actions runner, using TLS 1.2.

Steps To Reproduce:

1. Establish an mTLS connection to a localhost HTTPS server using CURLSSLOPT_AUTO_CLIENT_CERT and an ephemeral client certificate.
2. Close the physical connection while retaining the libcurl TLS session cache, then reuse the same easy handle to follow an HTTP redirect back to the HTTPS server.
3. With session caching enabled, the redirected connection resumes the authenticated TLS session over a new TCP connection, and the server reports the original client certificate identity in both TLS ticket and session-ID modes.
4. With session caching disabled, the redirected TLS handshake fails because no client certificate is provided.

Impact

An application following an attacker-influenced redirect could unintentionally access an mTLS-protected endpoint under a previously authenticated client identity, potentially bypassing the intended redirect authentication boundary.