vsftpd versions through 3.0.5 allow an unauthenticated attacker to bypass authentication by hijacking the FTPS data channel. The flaw resides in ssl_data_accept(), which fails to enforce TLS session reuse between the control and data connections. An attacker can obtain a TLS session ticket via AUTH TLS and then connect to the victim’s PASV port to steal or inject data, effectively bypassing access controls and enabling data exfiltration or manipulation. This weakness is categorized as CWE‑940, indicating misuse of cryptographic protocols.

The vulnerability affects the vsftpd FTP server up to and including version 3.0.5. Administrators using any of the vsftpd releases within this range on any platform are susceptible. No other vendor or product variants are listed as affected.

The CVSS score of 9.1 reflects a high impact authentication bypass with the potential for data theft. EPSS is not available, so the current exploitation probability cannot be quantified, but the lack of exploitation evidence does not diminish the severity. The vulnerability is not listed in the CISA KEV catalog, yet the attack path—using a shared source IP to hijack the data connection—has been demonstrated publicly. Given the simple command sequence required and the lack of prerequisite access, the risk to exposed FTPS services is significant.