Apache Traffic Server will resume a TLS session across multiple Server Name Indication (SNI) virtual hosts without re‑verifying the client certificate that is required by the target host’s verify_client STRICT policy, allowing an attacker who holds a certificate for one host to bypass client authentication on a different host that requires a certificate. This flaw directly undermines the integrity of client credential validation, exposing traffic to unauthorized or malicious users.

The issue affects Apache Traffic Server versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0, and does not impact newer releases such as 9.2.16, 10.1.5, or 10.2.1.

The CVSS score of 7.8 indicates moderate to high severity, but the EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting limited current exploitation evidence. The likely attack vector is remote: an unauthenticated attacker can initiate a TLS connection to an SNI host that requires a client certificate, obtain a session ticket, and later resume that session against a different SNI host where the certificate is not re‑verified, thereby bypassing local authentication checks. The vulnerability is exploitable without privileged access or special network conditions beyond normal TLS traffic. The patch removes the bypass by ensuring that client authentication is re‑validated on every resumed session.