CVE-2026-63650CWE-115CWE-295

CVE-2026-63650

published August 15, 2026

CVSS
2.0
EPSS
0%
Percentile
13.4
In the wild
Unconfirmed
What it is

OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field

The record
Technical detail
CVSS
2.0 · NONE
CVSS v4.0
2.0 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
EPSS
0.00228 · 13.4th percentile
Weaknesses
CWE-115 · Misinterpretation of Input; CWE-295 · Improper Certificate Validation
Published
2026-08-15T03:16Z
References (2)
https://community.openvpn.net/ReleaseHistory#openvpn-276-released-5-august-2026 · [email protected]https://community.openvpn.net/Security%20Announcements/CVE-2026-63650 · [email protected]
EPSS history
Timeline
  • 14 AUG 22:13Z
    OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup…
    cvelistv5