GoAhead TLS Vulnerability Allows Revoked Client Certificates to Bypass Authentication

A vulnerability in GoAhead's TLS implementation fails to enforce certificate revocation checks, allowing revoked client certificates to bypass authentication. This affects systems using OpenSSL with mutual-TLS and configured revocation lists, enabling potential session decryption.

The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups.

The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked

Read original article