The vulnerability allows a network attacker to forge or steal attestation evidence from a compromised unrevoked TEE platform. Because the verifier does not require an explicitly authorized platform identity, it accepts evidence that belongs to any unrevoked TEE as if it originated from the intended attester. The attacker can impersonate the attested TLS endpoint, potentially leading to man‑in‑the‑middle attacks and unauthorized data access. This flaw represents a serious authentication bypass, classified as CWE‑346.

The affected product is Privasys ra‑tls‑clients. All releases prior to version 0.11.0 are vulnerable; the fix was introduced in release v0.11.0. Users of any earlier version should consider their installations at risk until the update is applied.

The CVSS score of 9.1 highlights the high severity of this flaw. EPSS data is not available, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to involve a remote attacker who can forge or extract attestation secrets over a network and supply them to the TLS verifier. Once the evidence is accepted, the attacker can fully impersonate the TLS endpoint, gaining control over encrypted communications.