CVE-2025-23048

An access control bypass vulnerability was found in Apache httpd. The Apache HTTP Server with some mod_ssl configurations can bypass the access controls by trusted clients using TLS 1.3 session resumption. A client trusted to access one virtual host may be able to access another if SSLStrictSNIVHostCheck is not enabled on either host.

Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates. For example, with a different SSLCACertificateFile/Path setting.

This vulnerability is rated Moderate rather than Important due to the specific and uncommon configuration prerequisites needed for exploitation. The flaw allows a trusted client—one already holding valid client certificates for one virtual host—to potentially bypass access controls and access another virtual host by leveraging TLS 1.3 session resumption, only if the SSLStrictSNIVHostCheck directive is not enabled on either host. This bypass is not a general remote access issue, nor does it allow an unauthenticated or untrusted attacker to gain access. Furthermore, affected systems are those with complex, multi-tenant SSL client auth setups, which are relatively rare.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.