The issue concerns the RADIUS service in Server App, where it selects a fallback X.509 certificate under certain circumstances. This could potentially allow man-in-the-middle attackers to hijack RADIUS sessions if they have knowledge of the private key matching the fallback certificate.