Erlang/OTP SSL is vulnerable to a key‑exchange weakness that allows a malicious TLS 1.3 server to impersonate the intended target without presenting a valid certificate. The bug arises when the server sends a pre‑shared‑key extension that the client never offered; the client then accepts the handshake, skips all certificate validation steps, and establishes a secure channel with an attacker’s key. The result is that the client trusts the attacker as the legitimate server, enabling an unauthenticated man‑in‑the‑middle or replay of the connection.

The flaw affects Erlang/OTP releases from 22.2 up to the immediate predecessor of 27.3.4.18, as well as OTP 28.5.0.7 and OTP 29.1.1. Within those releases it applies to the default client configuration of the ssl application, specifically ssl versions 9.5 before 11.2.12.13, 11.6.0.6 and 11.7.7. All systems that depend on the standard Erlang/OTP ssl client using TLS 1.3 are potentially impacted, unless they have been configured to use TLS 1.2 only.

The CVSS score of 9.3 categorizes this as a high‑severity vulnerability. The EPSS score is unavailable, but the lack of existing exploitation examples combined with the widespread use of Erlang/OTP makes the risk significant. The vulnerability is not listed in the CISA KEV catalog at the time of this analysis. An attacker only needs to act as a server in a TLS 1.3 connection; no local privileges or additional access to certificates are required. Because the client skips certificate handling, the attacker can spoof any service without triggering normal TLS checks such as hostname verification, CRL or OCSP stapling.