The flaw lies in GnuTLS’s handling of RSA‑PSK authentication. When a client supplies a username that contains a NUL byte, the server truncates the string at the NUL and incorrectly matches the truncated value. A remote attacker can send a specially crafted username that contains a NUL character, causing the server to authenticate the attacker as if the username matched an existing account. This flaw enables attackers to bypass authentication entirely, potentially gaining unauthorized system access and compromising confidentiality, integrity, and availability of protected resources.

Affected systems include various Red Hat distributions that ship the vulnerable GnuTLS version: Red Hat Enterprise Linux 6, 7, 8, 9, and 10, as well as Red Hat Hardened Images and Red Hat OpenShift Container Platform 4. The flaw is implemented in the GnuTLS library and thus impacts all services on these platforms that rely on RSA‑PSK authentication.

The vulnerability carries a CVSS base score of 7.1, indicating a high severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog, so quantitative data on current exploitation probability is lacking. However, because it allows remote authentication bypass without any privileged state or local code execution, the theoretical risk remains substantial. Based on the description, it is inferred that the attack can be carried out over the network by an attacker who can initiate a TLS session and supply a crafted username; the necessary conditions are minimal, requiring only network access to an RSA‑PSK‑configured service.