A key exchange issue without entity authentication in the ssl module allows a peer responding to a TLS 1.3 client connection to impersonate the intended server. This occurs when a `pre shared key` extension is present in the `ServerHello` that the client did not offer, causing the client to complete the handshake without validating the server certificate. Specifically, `tls client connection 1 3:handle server hello/2` passes the extension to `tls gen connection 1 3:handle resumption/2`, which sets `resumption = true` without verifying if the client offered a PSK. Subsequently, `tls handshake 1 3:get pre shared key/4` falls back to an all-zero value, and the `maybe resumption/1` function routes directly to `wait finished`. This bypasses critical security checks including certificate path validation, `verify fun`, hostname verification, `partial chain`, CRL checking, and OCSP stapling. An attacker can intercept traffic, read sensitive data such as credentials and tokens, and forge responses. This affects any consumer of `ssl:connect` using TLS 1.3, including `httpc` over HTTPS and various database or messaging client libraries.