hackney performs certificate validation by adding a callback that treats any certificate in the peer chain whose public key matches a root in the bundled certifi store as the trust anchor. This callback overrides the caller‑supplied cacerts or cacertfile, allowing an attacker who can inject a TLS chain ending in a publicly trusted root to impersonate a server that is otherwise pinned to a private certificate authority. The attacker must still present a publicly trusted certificate for the target hostname, but the manipulated chain can satisfy that requirement, enabling man‑in‑the‑middle impersonation of the intended server.

The vulnerability affects benoitc hackney library versions starting at 1.24.0 and up through all releases before 4.9.0. Versions 4.9.0 and newer have fixed the check.

The vulnerability scores a CVSS of 9.1, indicating high severity. EPSS is not available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker must be able to intercept or tamper with the TLS handshake, implying a network‑level or on‑path position. Because hostname verification remains enforced, the attacker needs a publicly trusted certificate for the pinned hostname; however, the presence of the malformed chain still permits authentication bypass. The exploit requires no elevated privileges and can compromise secrecy and integrity of communications with the impacted server.