# CVE-2026-89422

TLS 1.3 client authentication bypass in Erlang/OTP ssl enabling server impersonation

- Page: https://www.vulneraibility.com/cve/CVE-2026-89422
- CVSS: 9.3
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.46% (percentile 40.0)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-09-22)
- Weakness: CWE-322
- Also known as: GHSA-rgxr-4g4w-j875
- Published: 2026-09-22

## Affected versions

- Erlang OTP: affected >= 22.2 and < *; >= 9.5 and < *; >= 21b8a1b0ad0adf200682b3854bc50114ab2b8c62 and < *

A version outside these ranges is not a statement that it is unaffected.

## Impact

TLS 1.3 handshake can skip certificate validation allowing attacker server impersonation/MITM and unauthenticated connections.

## Action

Immediate action required

## Recommendation

Upgrade OTP to the fixed versions now; disable TLS1.3 client or block untrusted peers temporarily.

## References

- [advisory] https://github.com/erlang/otp/security/advisories/GHSA-rgxr-4g4w-j875
- [other] https://cna.erlef.org/cves/CVE-2026-89422.html
- [other] https://osv.dev/vulnerability/EEF-CVE-2026-89422
- [other] https://www.erlang.org/doc/system/versions.html#order-of-versions
- [other] https://github.com/erlang/otp/commit/21b8a1b0ad0adf200682b3854bc50114ab2b8c62
- [patch] https://github.com/erlang/otp/commit/afec5156361bb50d3607c7c1a453c19b9149b324
- [patch] https://github.com/erlang/otp/commit/98c66c858113949c4262d26cd7d426c4b09d2b35
- [patch] https://github.com/erlang/otp/commit/fd1d9d07fc92ec0d59f96dfb66182195882bb7dd

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.