CVE-2026-45388 affects OCaml-TLS client implementations prior to version 2.1.0. The vulnerability arises because the client does not adequately verify that the server's certificate is intended for server authentication, specifically failing to enforce KeyUsage and ExtendedKeyUsage constraints. This can enable attackers to present certificates not meant for server authentication and successfully impersonate a legitimate server, potentially leading to man-in-the-middle attacks and compromise of confidential data. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact.

An attacker can impersonate a legitimate server by using a certificate that does not have the proper KeyUsage and ExtendedKeyUsage attributes for server authentication. This can lead to interception or manipulation of sensitive data transmitted between the client and server, compromising confidentiality and integrity. There is no known public exploit at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor for updates from the OCaml-TLS maintainers. Until a fix is available, avoid using vulnerable versions in security-critical environments or implement additional certificate validation checks externally if possible.