CVE-2026-63650

EUVD-2026-58813
OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
OpenVPNCNA
2 LOW
NETWORK
HIGH
LOW
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 29.53%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
openvpnopenvpn
𝑥
< 2.7.6
CNA
Common Weakness Enumeration
References
https://community.openvpn.net/ReleaseHistory#openvpn-276-released-5-august-2026
https://community.openvpn.net/Security%20Announcements/CVE-2026-63650