The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups.The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked
First seen on thehackernews.com
Jump to article: thehackernews.com/2026/10/goahead-tls-flaws-allow-revoked-client.html
