A critical authentication bypass vulnerability in Erlang/OTP allows remote, unauthenticated attackers to perform man-in-the-middle attacks by bypassing TLS 1.3 certificate validation.

This flaw involves a failure to properly validate the pre_shared_key extension in TLS 1.3 handshakes, which leads to the skipping of certificate verification, hostname validation, and OCSP checks. The vulnerability is triggered by unauthenticated peers during a connection attempt, effectively allowing an attacker to masquerade as a legitimate server.

Successful exploitation of this vulnerability permits unauthorized actors to intercept, view, or modify sensitive encrypted communications between the client and a spoofed server. Given the CVSS score of 9.3, this represents a critical risk to data confidentiality and integrity, potentially leading to the compromise of credentials, session tokens, or sensitive business data. The bypass of foundational TLS security mechanisms undermines the entire trust model of the affected applications.

Immediate Action: Upgrade to Erlang/OTP versions 27.3.4.18, 28.5.0.7, 29.1.1, or later, which contain the necessary logic to validate pre_shared_key extensions against offered parameters.

Proactive Monitoring: Monitor network traffic for unusual TLS 1.3 handshake patterns or certificate mismatches in logs, though note that this vulnerability specifically bypasses standard certificate validation logic.

Compensating Controls: As a temporary measure, restrict client-side configurations to force the use of TLS 1.2, which is not affected by this specific handshake flaw.

Public Exploit Available: Unknown

This vulnerability presents a severe risk to secure communications and should be treated with the highest priority. Administrators must prioritize the deployment of the vendor-supplied patches to all systems utilizing Erlang/OTP for TLS 1.3 connections. Where immediate patching is not feasible, enforcing TLS 1.2 as a fallback protocol is strongly recommended to mitigate the threat of impersonation.