CVE-2026-5479: wolfSSL: EVP ChaCha20-Poly1305 decryption returns plaintext without verifying authentication tag

wolfSSL's EVP compatibility API for ChaCha20-Poly1305 decryption (wolfSSL_EVP_CipherFinal on the AEAD path) returns the decrypted plaintext to the caller without verifying that the Poly1305 authentication tag matches. The AEAD's authenticity guarantee — the entire point of using an authenticated cipher — silently disappears.

Concretely: a consumer that uses the EVP API in the standard pattern (EVP_DecryptInit_ex → EVP_DecryptUpdate → EVP_DecryptFinal_ex, or the streaming EVP_CipherUpdate/EVP_CipherFinal equivalents) and ends with a tag check sees EVP_DecryptFinal_ex return success on every input — including ciphertexts with a tag that doesn't match, including ciphertexts where individual bytes have been flipped. Any active network attacker on the wire (or anyone supplying ciphertext to such a consumer) can forge messages that the application will treat as integrity-validated. Network adjacency (CVSS AV:A) reflects the typical deployment where wolfSSL EVP is used as a TLS-record / packet-AEAD primitive, not the strict TLS handshake path.