The vulnerability in OCaml-TLS prior to version 2.1.0 involves insufficient validation of client certificates during client authentication. Specifically, the server fails to enforce proper checks on the KeyUsage and ExtendedKeyUsage extensions of the certificate, which are critical to ensuring that a certificate is authorized for client authentication. This flaw could allow an attacker to use a certificate that is not meant for client authentication to impersonate a legitimate client to the server.

An attacker could bypass intended certificate usage restrictions and impersonate a client by presenting a certificate that lacks the appropriate KeyUsage or ExtendedKeyUsage attributes for client authentication. This undermines the trust model of client authentication in OCaml-TLS servers and could lead to unauthorized access or actions performed under the guise of a legitimate client.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider alternative mitigations such as additional application-layer checks or disabling client certificate authentication if feasible.