01 Record

CVE-2026-63650

OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field

LowPUBLISHEDCNA: OpenVPN

Base score2.0 CVSS v4.0CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

View raw JSON CVE Program record

02 Description

OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field

03 Metadata

Published

2026-08-14 22:13Z1 HR AGO

Last updated

2026-08-14 22:13Z1 HR AGO

Reserved

2026-07-17

Assigning CNA

OpenVPN

Record state

PUBLISHED

Severity

Low (CVSS 2.0)

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Weaknesses

CWE-115Misinterpretation of InputBase
CWE-295Improper Certificate ValidationBase

SSVC decision

No CISA-ADP assessment

Data version

5.2

Document digest

2c551817e7155d33c0a3a31479b0254bc78b27690f4776b2f7208d3e414c07dc

04 Affected products

VendorProductVersionsPlatforms

OpenVPNOpenVPN2.7_alpha1 to < 2.7.6—

05 References

community.openvpn.nethttps://community.openvpn.net/Security%20Announcements/CVE-2026-63650vendor-advisory
community.openvpn.nethttps://community.openvpn.net/ReleaseHistory#openvpn-276-released-5-august-2026release-notes