The flaw allows an attacker who has extracted the attested TLS private key to forward the relying party’s nonce to a legitimate attester and replay its attestation evidence. Because the software fails to bind this evidence to the TLS session, the replayed evidence is accepted as authentic. This enables the attacker to convincingly impersonate the intended workload and intercept or modify data flowing through the TLS connection.

The vulnerability exists in the open‑source CCC‑Attestation attested‑tls‑poc project, specifically in versions prior to commit 731ca82. Any deployment of this code that relies on early attestation evidence for identity verification is susceptible until the patch that properly ties evidence to the TLS connection is applied.

The CVSS base score of 9.1 categorizes this as a critical flaw. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. The attack requires the attacker to possess an extracted attested TLS private key and to have network reach to both the target and a genuine attester. Once those conditions are met, the exploit can be executed remotely over the network by replaying valid evidence.