An improper access control flaw in Apache Traffic Server allows the server to ignore the required alignment between the SNI field of TLS handshakes and the Host header received in the HTTP request. The missing enforcement means that the server may resolve a request to a virtual host based solely on the SNI value, while the Host header may reference a different domain. This can let an attacker access content or services that belong to another virtual host, potentially exposing confidential data or enabling further attacks.

The vulnerability affects Apache Traffic Server versions 9.0.0 through 9.1.14 and 10.0.0 through 10.1.3. Administrators should review any deployments that use these versions and plan for an upgrade.

The CVSS score of 7 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild at present, and the issue is not listed in CISA KEV. The exploit requires an attacker to send a TLS request with an SNI value that does not match the HTTP Host header; if the server resolves the request based on the SNI alone, the attacker can retrieve resources intended for a different host. Proper enforcement would prevent this mismatch and the associated unauthorized access.