The issue allows remote attackers to spoof certificate fingerprints, enabling them to log in as another user. This is achieved by crafting the `AUTHENTICATE` parameter. The `m authenticate` function in `modules/m sasl.c` is specifically vulnerable to this type of attack.