The vulnerability in Erlang/OTP ssl arises from a key exchange without entity authentication during TLS 1.3 handshakes. Specifically, if a server sends a pre_shared_key extension in the ServerHello message that the client did not offer, the client incorrectly sets a resumption flag and skips certificate validation steps such as certificate path validation, hostname verification, and OCSP stapling. This allows an attacker to complete the handshake and impersonate the server without possessing a certificate or private key. The flaw affects OTP versions from 22.2 before 27.3.4.18, 28.5.0.7, and 29.1.1, corresponding to ssl versions from 9.5 before 11.2.12.13, 11.6.0.6, and 11.7.7. Clients restricted to TLS 1.2 are not affected.

An attacker can impersonate the intended TLS 1.3 server to a client by exploiting the improper handling of the pre_shared_key extension, bypassing all certificate validation mechanisms. This undermines the authenticity guarantees of TLS 1.3 connections, potentially enabling man-in-the-middle attacks or unauthorized access to sensitive data transmitted over the connection. The vulnerability affects default client configurations using TLS 1.3 but does not impact clients restricted to TLS 1.2.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects specific OTP and ssl versions as detailed. Users should monitor official Erlang/OTP advisories for patches or updates addressing this issue. Until a fix is applied, restricting clients to TLS 1.2 may mitigate exposure as those clients are not affected.