The vulnerability arises because Apache bRPC clients validate the server’s certificate chain but do not bind that certificate to the expected DNS name or IP address. When TLS peer verification is enabled, a client is still susceptible to a man‑in‑the‑middle if an attacker can redirect the traffic and presents a certificate issued by a trusted CA for a different host. The attacker can thereby impersonate the intended endpoint, leading to potential confidentiality compromise and unauthorized data access.

All Apache bRPC components before version 1.18.0 are affected, as specified by the vendor. The issue is relevant for any application that uses a bRPC client channel over an untrusted network while TLS verification is active and trusts a CA capable of issuing certificates for namespaces other than the intended endpoint. No specific deployment class is singled out, so any instance of the library under the affected version range is vulnerable.

The lack of hostname checking creates a moderate‑risk TLS impersonation vector. The CVSS score of 5.9 indicates medium severity. EPSS is <1%, suggesting low probability of exploitation in general, but a network attacker with control and a trusted CA certificate can still impersonate the intended endpoint. The flaw is not currently in the CISA KEV catalog.