NewsThe Hacker News27.10.2026

GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked

Other advisories

CriticalCVE-2026-115881GoAhead embedded web server: 6.1.1 fixes critical auth-bypass, mTLS revocation and Windows CGI flaws
CriticalCVE-2026-36356The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injection via the /act…
CriticalCVE-2026-36356Der GoAhead Webserver auf den MeiG Smart FORGE_SLT711-Geräten (Firmware MDM9607.
CriticalCVE-2026-36356Der GoAhead-Webserver auf MeiG Smart FORGE_SLT711-Geräten (Firmware MDM9607.
HighCVE-2023-53155EmbedThis GoAhead: Cross-Site-Scripting (XSS)
HighCVE-2023-53155EmbedThis GoAhead: Cross-Site-Scripting (XSS)
MediumCVE-2024-3187EmbedThis GoAhead: Use-After-Free
MediumCVE-2024-3186EmbedThis GoAhead: Null-Pointer-Dereferenzierung

Source: https://thehackernews.com/2026/10/goahead-tls-flaws-allow-revoked-client.html

More on GoAhead

Other advisories