Reported by 1 outlet
CVE-2026-89422: Erlang/OTP SSL TLS 1.3 Client Auth Bypass (CVSS 10)
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 4.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
CVE-2026-89422 is a CVSS 10 vulnerability in Erlang/OTP's SSL TLS 1.3 client authentication. A malicious server can impersonate any host without requiring a valid certificate, bypassing TLS 1.3 client auth checks. The patch is under review but not yet released. The source valtersit.com flagged the flaw.
This is a protocol-level authentication bypass in a core runtime used by Erlang-based applications. Any service relying on Erlang/OTP TLS client auth for identity verification is exposed to complete impersonation. Watch for the official patch and audit Erlang services that depend on client certificate validation for access control.
Timeline
-
original reporting
CVE-2026-89422: Erlang/OTP ssl TLS 1.3 client auth bypass. Malicious server impersonates any host, no cert required. CVSS 10. Patch under re
www.valtersit.com · 12d ago · October 2nd, 2026
CVE-2026-89422: Erlang/OTP ssl TLS 1.3 client auth bypass. Malicious server impersonates any host, no cert required. CVSS 10. Patch under re
via Mastodon https://www.valtersit.com/cve/CVE-2026-89422/