CVE-2014-3603: Improper Validation of Certificate with Host Mismatch in Shibboleth Identity Provider and OpenSAML Java

The vulnerability stems from missing hostname verification in HTTP client configuration. The OpenSAML DefaultBootstrap class initializes security components and HttpClient settings. The patch added hostname verifier registration in initializeXMLSecurity(), indicating this was the missing security control. HttpClientBuilder would be responsible for creating vulnerable client instances with default insecure settings. These functions would appear in stack traces during MITM exploitation when establishing insecure HTTPS connections to fetch resources.