GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

A vulnerability in the GoAhead embedded web server allows revoked client certificates to still be accepted for login. This occurs because the server loads a certificate revocation list but does not enable revocation checking. The issue affects setups using the OpenSSL backend with mutual-TLS authentication, where both the server and client verify each other's certificates. In these cases, a revocation list is typically used to block revoked certificates, but the flaw renders this ineffective. As a result, revoked client certificates can still pass authentication on affected systems. This vulnerability also enables session decryption.