Critical Erlang/OTP SSL Flaw Lets Attackers Bypass TLS Server Authentication

A critical vulnerability tracked as CVE-2026-55953 affects Erlang/OTP SSL clients using TLS 1.2 and earlier as well as DTLS, allowing an on-path attacker to bypass server authentication and intercept supposedly secure sessions. The flaw occurs because the client does not verify that the cipher suite selected by the server was actually offered in the ClientHello, enabling an attacker to force an anonymous cipher suite and complete the handshake without certificate validation or hostname checking. Once the connection is established, the attacker can read and modify traffic; TLS 1.3 is not affected because it already performs the required cipher-suite membership check.

The issue affects Erlang/OTP from OTP 17.0 up to the patched releases 27.3.4.15, 28.5.0.4, and 29.0.4, with corresponding SSL fixes in 11.2.12.11, 11.6.0.4, and 11.7.4. Erlang/OTP maintainers addressed the bug in July with code changes to ssl_handshake.erl that add a pre-TLS 1.3 client cipher-suite validation check and trigger a fatal illegal_parameter alert if the negotiated suite was not advertised by the client. The vulnerability carries a CVSS 4.0 score of 9.1 and is classified under CWE-757.