An authentication bypass flaw was found in the way the EAP module in FreeRADIUS handled TLS session resumption. A remote unauthenticated attacker could potentially use this flaw to bypass the inner authentication check in FreeRADIUS by resuming an older unauthenticated TLS session.
Mitigation:
Disable TLS session caching in FreeRADIUS by setting "enable = no" in the cache subsection of EAP module settings, which are in /etc/raddb/mods-available/eap file.