A critical flaw in the GoAhead embedded web server lets revoked client certificates pass authentication checks, potentially restoring access to identities administrators have blocked. Tracked as CVE-2026-115881, the vulnerability carries a CVSS score of 9.1 and affects GoAhead 3.4.5 through 6.1.0 when specific mutual TLS settings are enabled. GoAhead 6.1.1 fixes the issue.

Revocation that does not revoke

The flaw matters because certificate revocation is how administrators cut off a compromised or departed identity: if a revoked certificate still passes, the block does not hold. Related findings in the same advisory set include a chain-depth enforcement issue, GOAHEAD-SA-2026-0004, affecting certain LibreSSL releases when VERIFY_ISSUER is set to 0, and a malformed parameter issue in which a one-byte modulus was supplied instead of the intended 2048-bit value, undermining session confidentiality when clients accepted it. Exposure depends on the TLS backend and verification settings chosen, so not every device embedding GoAhead is vulnerable to every flaw in the set.

Fix, then prove the block works

Device manufacturers and administrators should rebuild and redeploy affected installations, prioritising systems using mutual TLS. After upgrading, validation should confirm that revoked client certificates actually fail authentication, rather than relying on clean startup logs or successful loading of a revocation list. Until patched builds are deployed, restricting management and client-certificate endpoints to trusted networks reduces exposure, but does not replace the fix.

Sources: IT Security News (GBHackers) and CyberPress.