The vulnerability is an improper following of a certificate's chain of trust in Erlang OTP's public_key module; a non-CA certificate that lacks a basicConstraints cA:true flag and keyUsage keyCertSign can be accepted as an intermediate issuer. This flaw lets an attacker, who possesses an end-entity certificate issued by a trusted CA, use that certificate's private key to forge arbitrary leaf certificates for any identity. The forged chain is then considered valid by public_key:pkix_path_validation/3, which underlies all TLS and mutual TLS endpoints built on the OTP ssl application. The impact is the ability to spoof identities and perform man-in-the-middle or impersonation attacks, compromising integrity and confidentiality of communications.

The vulnerability affects Erlang OTP releases from 17.0 up to and including 28.5.0.1, and also includes 27.3.4.12 and 26.2.5.21, so any OTP distribution prior to 29.0.1 is vulnerable. Correspondingly, the public_key library versions 0.22 through 1.20.3.1, 1.17.1.3 and 1.15.1.7 are affected. All systems running these OTP releases and relying on the default path validation are impacted.

The CVSS score of 7 indicates a high severity vulnerability. The EPSS score is below 1%, indicating very low but non-zero exploitation probability, and the absence of a KEV listing suggests no widely known public exploitation. The attack vector is clear: any compromised end-entity key can generate forged certificates that the verifier will accept. The flaw requires only possession of a private key and does not require elevated privileges or network access by the attacker beyond delivering the forged chain to a verifier. Consequently, the risk remains high for systems that have not applied an official patch or mitigated the validation logic.