The GoAhead embedded web server has been found to contain a significant security flaw, allowing revoked client certificates to bypass login protocols. This issue arises because the server loads a certificate revocation list but fails to activate revocation checks, thus permitting unauthorized access.
Details of the Security Flaw
Identified in configurations using the OpenSSL backend with mutual-TLS, the flaw affects server-client certificate checks where a revocation list is configured. The vulnerability persists in versions prior to GoAhead 6.1.1, which was released to manufacturers in August and publicly made available in October.
The issue was uncovered by Sébastien Féry from FoxIO, who outlined this and other TLS vulnerabilities in a recent report. During tests, revoked certificates were erroneously accepted, posing a risk of unauthorized access. The vulnerability is specifically problematic in builds requiring client certificates, with a trusted certificate authority and issuer checking enabled.
Impact and Affected Versions
This vulnerability, cataloged as CVE-2026-115881, is rated 9.1 in severity by EmbedThis. It impacts builds utilizing OpenSSL from versions 3.4.5 to 6.1.0. The Mbed TLS backend is not affected as it employs a different revocation checking method.
FoxIO also noted two additional issues related to specific TLS builds. These include an acceptance of overlong certificate chains in LibreSSL versions and a decryption vulnerability in Mbed TLS versions. Each flaw has different affected versions and recommended mitigations, primarily advising upgrades to version 6.1.1.
Response and Mitigation Measures
As of late October, there have been no reports of these vulnerabilities being exploited. However, EmbedThis has ended its disclosure embargo to facilitate timely patching. Device manufacturers are urged to upgrade to GoAhead 6.1.1 to mitigate these risks.
EmbedThis recommends users to end active sessions and change Blowfish-stored passwords post-upgrade, especially for servers using HTTP Basic or form login settings. The update addresses a total of 11 advisories, including critical vulnerabilities like login bypasses.
While the exact number of affected devices remains unclear, companies using GoAhead, such as HP, Oracle, and Siemens, are advised to review their systems for potential exposure.
