Prior to version 0.13.0, the mod_gnutls module for Apache HTTPD failed to validate the key purpose specified in the Extended Key Usage extension during client certificate verification. An attacker possessing the private key of a certificate issued by a CA trusted for TLS client authentication but intended for another purpose could present that certificate during a TLS handshake, causing the server to accept it and grant access to resources protected by client‑certificate verification. This results in an unauthorized bypass of authentication, potentially compromising confidentiality and integrity of data accessed through such resources.

The vulnerability impacts all releases of the Airtower‑Luna mod_gnutls module prior to 0.13.0. Server configurations that do not enforce client certificate verification (e.g., GnuTLSClientVerify set to ignore, which is the default) are not affected. If a deployment uses dedicated CAs that issue only client authentication certificates, the flaw poses no practical risk.

The CVSS score of 6.8 indicates a medium severity vulnerability with potential for significant impact if client certificate verification is in use. The EPSS score is below 1%, suggesting limited exploitation activity to date, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to control a certificate issued for an alternative purpose by a trusted CA, and the server to require client authentication. For organizations that rely on client certificates for access control, prompt remediation is advisable to mitigate the risk of unauthorized access.