CVE-2025-23048 Apache HTTP Server: mod_ssl access control bypass with session resumption
Trusted clients can bypass access controls and access restricted virtual hosts via TLS session resumption in specific multi-vhost configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-23048?
CVE-2025-23048 is a critical authentication bypass vulnerability in Apache Http Server, published on 10 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.
Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
Weakness: CWE-284
Which versions are affected by CVE-2025-23048?
1 open source package ship an affected version, including apache. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apache Bitnami | From 2.4.35 | 2.4.64 |
Products include Apache Http Server.
How do I fix CVE-2025-23048?
Upgrade apache to 2.4.64 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-23048 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-23048 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Apache Http Server
Sources
Also known as ALPINE-CVE-2025-23048, AZL-65163, AZL-65223, BELL-CVE-2025-23048, BIT-apache-2025-23048, CLSA-2025-1757428404 and 5 more.