The flaw allows an attacker to intercept TLS connections that use Python's ssl.get_server_certificate with the ca_certs argument, because the function verifies the certificate chain but does not verify that the certificate belongs to the intended host. This omission permits a man‑in‑the‑middle attack in which a malicious server presents a trusted certificate chain to the client while the identity of the host is never verified, potentially exposing sensitive data and enabling credential theft.

Affected systems are CPython implementations distributed by the Python Software Foundation. No specific version range is provided, so any release that contains the unpatched ssl module may be vulnerable. Administrators should review the Python changelog for a fix once available.

The EPSS score is not available and the vulnerability is not listed in CISA KEV, but the lack of hostname verification makes it a serious risk. The likely exploitation path involves passive network interception or DNS spoofing; however, this inference is based on the nature of the vulnerability rather than explicit statement in the data. The CVSS metric is missing, and the potential impact on confidentiality, integrity, and availability warrants immediate attention.