Contour versions 1.23.0 through 1.33.4 have a vulnerability where enabling fallback TLS certificates on virtual hosts with JWT providers configured allows requests without valid TLS SNI to bypass JWT verification. This misconfiguration results in unauthenticated requests being proxied to upstream services. The issue is fixed in version 1.33.5, which rejects invalid configurations combining fallback certificates and JWT providers.