The vulnerability arises because the TLS 1.3 client connection handler in Erlang/OTP ssl incorrectly processes a pre_shared_key extension in the ServerHello message that the client never offered. This sets a resumption flag without verifying the client's PSK offer, causing the handshake to proceed without proper certificate validation. As a result, the client accepts a server that presents no certificate, private key, or prior session, enabling impersonation. The flaw affects default client configurations that support TLS 1.3, but not clients restricted to TLS 1.2. Affected versions include OTP from 22.2 before 27.3.4.18 and ssl from 9.5 before 11.2.12.13, among others.

An attacker can impersonate the intended server during a TLS 1.3 handshake, bypassing all certificate validation steps including certificate path validation, hostname verification, and revocation checks. This undermines the authenticity guarantees of TLS connections, potentially exposing clients to man-in-the-middle attacks without any user interaction or prior authentication.

A fix is available in Erlang/OTP versions 27.3.4.18, 28.5.0.7, and 29.1.1, and corresponding ssl versions 11.2.12.13, 11.6.0.6, and 11.7.7. Users should upgrade to these or later versions to remediate the vulnerability. There is no indication that the vulnerability is mitigated by configuration changes alone. Patch status is confirmed by the vendor advisory information.