AIKIDO-2026-84593

TL;DR

tls_handshake:hello/5 validates the negotiated protocol version and downgrade sentinel but passes the server-chosen cipher suite to ssl_handshake:handle_server_hello_extensions/9 without checking it was offered in ClientHello. An on-path attacker can reply with an anonymous suite such as TLS_ECDH_anon_* or TLS_DH_anon_* that the client never offered. Those suites skip certificates, so verify_peer / cacerts are bypassed, ssl:connect still returns {ok, Socket}, and the attacker can read and modify all application traffic. TLS 1.3 clients are not affected. The fix rejects a server-selected cipher suite that was not among those offered by the client.