Session hijacking via nonmatching TLS certificate acceptance

Improper certificate validation in HashiCorp Boundary and Boundary Enterprise before 0.15.0 allows remote authenticated users to hijack sessions. During worker-side TLS verification, the server accepts a custom per-session certificate when its DNS SAN names the target session instead of requiring the exact certificate issued at authorization. Exploitation requires another valid session private key plus the target session ID and, for active sessions, its TOFU token; successful access reaches the underlying service, while default permissions and immediate client connection sharply limit the window.