Apache Thrift's Python TSSLSocket contains a flaw where the hostname matcher is imported incorrectly, resulting in improper validation of certificates that do not match the intended host. This weakness, identified as CWE-297, means an attacker could potentially present a certificate issued for a different host and still be trusted by client applications, thereby undermining the authenticity of the TLS handshake and enabling man‑in‑the‑middle attacks or impersonation.

The issue affects Apache Thrift 0.23.0 and earlier versions of the Python bindings shipped by the Apache Software Foundation. Users running these earlier releases are exposed to the vulnerability until they upgrade to a fixed release.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score is < 1%, indicating a low likelihood of exploitation. Based on the description, it is inferred that the likely attack vector is over the network when an attacker initiates a TLS connection to a client using the affected bindings; the compromised hostname validation could be combined with a forged certificate matching any domain to bypass authentication. Though the vulnerability is not listed in CISA's KEV catalog, it remains a significant concern for deployments that rely on strict TLS host verification.