A weakness in Contour prevents correct enforcement of JSON Web Token verification when an HTTPProxy is configured with both a fallback certificate and a JWT provider. As a result, remote attackers can send requests without a valid token when they do not supply a TLS Server Name Indication (SNI) or provide an unrecognized SNI, leading to unauthorized access to upstream services and possible disclosure of sensitive information. The flaw reflects the failure of Contour to correctly combine certificate handling with authentication validation (CWE‑295).

The vulnerability applies to any Contour installation that uses an HTTPProxy resource configured with both a fallback certificate and a JWT provider. No specific Contour version numbers are listed in the advisory, so any deployment matching this configuration is potentially affected regardless of software version.

The CVSS base score of 6.5 indicates a moderate risk level. EPSS is not available, so the likelihood of exploitation cannot be quantified, and the issue is not listed in CISA’s KEV catalog. Attackers can exploit the flaw remotely by establishing TLS connections that omit a valid SNI or use an unrecognized SNI, allowing them to send unauthenticated HTTP requests that Contour accepts as valid due to the bypassed JWT verification. No privileged access or user interaction beyond the crafted request is required, and the scope of impact remains the services exposed through the affected HTTPProxy configuration.