This vulnerability in Mbed TLS before version 3.6.1 involves improper validation of client certificates during TLS 1.3 optional client authentication. Specifically, if the client certificate lacks appropriate values in the keyUsage or extendedKeyUsage extensions, the server may not correctly enforce authentication requirements. The flaw is identified under CWE-295 (Improper Certificate Validation). The affected products include Microsoft Azure Linux and CBL Mariner 2.0 distributions. No patch or remediation details are provided in the available data.

The impact is that a server using Mbed TLS for TLS 1.3 optional client authentication might accept client certificates that do not meet the expected usage constraints, potentially weakening authentication guarantees. This could allow unauthorized clients to be accepted if the certificate validation is insufficient. No evidence of active exploitation is reported.

Patch status is not yet confirmed — check the Microsoft Security Response Center advisory for current remediation guidance. Until a fix is available, administrators should consider disabling optional client authentication or implementing additional certificate validation controls if feasible.