STEK Sharing is Not Caring: Bypassing TLS Authentication in Web Servers Using Session Tickets#
USENIX Security '25 (34th USENIX Security Symposium) digest Program Core pick 13–15 August 2025
Sven Hebrok et al., Paderborn University — Core
- Why: A concrete, large-scale-confirmed TLS authentication bypass in virtual hosting — exactly the multi-tenant TLS-termination pattern common in cloud/CDN infrastructure — affecting Apache, nginx, (Open)LiteSpeed, and Caddy, plus real providers including Fastly.
- What: Session ticket confusion vulnerabilities in TLS session resumption under virtual hosting, where a shared Session Ticket Encryption Key (STEK) across virtual hosts on one physical server breaks isolation, enabling bypass of client and server authentication. All four tested server implementations were vulnerable to client-auth bypass; a large-scale scan found six clusters of providers vulnerable to server-auth bypass. (from abstract only)
- How: Exploits inconsistent STEK handling across virtual hosts sharing one physical server during TLS session resumption to confuse which host a resumed session actually authenticates. (from abstract only)
- Where applicable: General for any TLS termination point serving multiple virtual hosts/tenants from shared infrastructure with session-ticket resumption enabled — a direct operational risk for multi-tenant edge/CDN/load-balancer deployments.