## GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

- 種別: news
- 関連技術: openssl
- 公開日時: 2026-10-27T13:59:48.000Z
- 情報源: The Hacker News (https://thehackernews.com/2026/10/goahead-tls-flaws-allow-revoked-client.html)
- パーマリンク: https://vulnpulse.app/items/thehackernews-dc1f78b83e65

The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked