The Erlang OTP public_key module fails to enforce the CA flag during path validation, allowing a certificate with basicConstraints cA:false to act as an intermediate issuer. An attacker who owns a valid end‑entity certificate can use its private key to sign fraudulent leaf certificates and inject them into a chain that OTP’s default validator will accept, resulting in forged certificates that can be used for impersonation or man‑in‑the‑middle attacks.

Erlang:OTP is affected. Vulnerable OTP releases include all versions from 17.0 up to but not including 27.3.4.19, the releases 28.5.0.8 and 29.1.2, and the corresponding public_key libraries from 0.22 through the ones just before 1.17.1.7, 1.20.3.6 and 1.21.8. Earlier OTP releases prior to 17.0 (public_key before 0.22) are not confirmed to be vulnerable.

The CVSS score is 7, indicating high severity, while the EPSS score is below 1 %, showing a low but non‑zero probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, so no public exploitation is known. Attacks require possession of a legitimate end‑entity private key; once a forged chain is constructed, the OTP SSL stack will accept it, allowing the attacker to impersonate the target identity. The flaw bypasses both the basicConstraints CA flag and keyUsage enforcement when the extension is missing, raising the impact for any TLS or mTLS application that relies on the default verifier.