Erlang/OTP EUVD-2026-101387

Requires all of: (1) a server terminating multiple SNI virtual hosts from a single listen socket via sni_fun or sni_hosts; (2) pre-TLS 1.3 negotiation (TLS 1.2 or earlier) - TLS 1.3 does not use the affected session cache and is NOT vulnerable; (3) a target SNI host whose option set switches to verify_peer without explicitly setting reuse_sessions, so it inherits the base listener's reuse_sessions=true and the auto-disable-for-client-auth default never applies; (4) the two SNI names must share a server certificate (common with wildcard or multi-SAN certificates); and (5) the attacker must already hold a client certificate trusted by at least one of the virtual hosts. Limiting factors: configurations that pin reuse_sessions=false per SNI host, use distinct certificates per name, or run TLS 1.3 are not exploitable, substantially narrowing the real-world attack surface.

This is a genuine but conditional authentication-bypass/trust-confusion flaw rather than a mass-exploitation priority. The provided CVSS 4.0 vector (6.3, Medium) tells a consistent story: AV:N (reachable over the network), AC:L but AT:P (a specific attack requirement must be present - namely a resumable TLS 1.2 session and a shared server certificate), PR:N, UI:N, with only low confidentiality and integrity impact (VC:L/VI:L) and no availability or subsequent-system impact. No EPSS score was supplied, and the CVE is NOT in CISA KEV and has no public POC, so exploitation status is: no public exploit identified at time of analysis. The AT:P requirement is the dominant risk-limiting signal - exploitation depends on a fairly narrow server configuration (multiple SNI vhosts on one listener, pre-TLS 1.3, inherited reuse_sessions=true, and a certificate shared across names). One caveat worth flagging: the CVSS vector assigns PR:N, yet the attacker must already hold a client certificate trusted by one of the virtual hosts, which is effectively a credential/privilege precondition - I assess this closer to PR:L (see assessed vectors). Net: a real correctness/trust bug worth patching on affected mutual-TLS SNI deployments, but not a drop-everything internet-wide emergency.

A server hosts several SNI virtual hosts on one listener using sni_fun or sni_hosts, where one host (B) requires client-certificate authentication (verify_peer) and the hosts share a wildcard or multi-SAN server certificate. An attacker who legitimately holds a client certificate trusted only by host A completes a normal TLS 1.2 handshake with host A, then opens an abbreviated (resumption) handshake to host B reusing that session; because the cached session is not bound to the original SNI name or trust policy, the server accepts the attacker as authenticated to host B. No public exploit code is known, and the attack is constrained by the AT:P attack requirement in the CVSS vector.