Apache Traffic Server’s default outbound session‑sharing policy ignores the MASK_CERT flag, allowing a TLS session authenticated with one client certificate to be reused for requests configured to present a different certificate. This flaw enables an attacker to present a non‑authorized certificate while still leveraging a pooled session that was originally established under a legitimate identity, thereby bypassing the required client‑certificate authentication on the origin server. The weakness is classified as improper authentication (CWE‑295) and can lead to unauthorized access and potential data exposure.

The issue affects Apache Traffic Server releases from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, and the single 10.2.0 release. The official fix is provided in versions 9.2.16, 10.1.5, and 10.2.1 respectively; users operating any of the impacted releases should plan an upgrade.

With a CVSS score of 7.8 the vulnerability is considered high severity; the EPSS score of < 1% indicates a very low but nonzero probability of exploitation, and it is not listed in the CISA KEV catalog. The likely vector involves outbound Traffic Server connections to an origin that requires a specific client certificate; an attacker who can instruct Traffic Server to use a session backed by a different certificate can exploit the bug. Given the authentication bypass and potential for attacker impersonation, a moderate to high risk profile justifies immediate remediation.