https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882 reports:
The OTP TLS/DTLS client (pre TLS-1.3) does not verify that
the cipher suite selected by the server in ServerHello is one
of those offered in ClientHello. A man-in-the-middle attacker
can select an anonymous cipher suite such as ECDH_anon that
was never offered by the client. Since anonymous suites do not
require a server certificate, this completely bypasses the
client's verify_peer setting, giving the attacker a fully
established connection without possessing any trusted
certificate, and thus complete read and modify access to the
transmitted data. TLS-1.3 is not affected.