The security researcher Stefan Winter has discovered a TLS resumption authentication bypass in FreeRADIUS, the worlds most popular RADIUS Server. The flaw, tracked as CVE-2017-9148, resides in the TTLS and PEAP implementations that skip inner authentication when handles a resumed TLS connection. The server must never allow resumption of a TLS session until its initial connection gets to the point where inner authentication has been finished successfully. All versions affected by the flaw need to upgrade to the version 3.0.14 that fixed the issue.”]