CVE-2026-63650

Received Received - Intake

OpenVPN mbedTLS X.509 Username Identity Misidentification

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: OpenVPN Inc.

Description

OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-14

Last Modified

2026-08-14

Generated

2026-08-15

AI Q&A

2026-08-15

EPSS Evaluated

N/A

NVD

CVE-2026-63650

EUVD

EUVD-2026-58813

Affected Vendors & Products

Vendor	Product	Version / Range
openvpn	openvpn	From 2.7_alpha1 (inc) to 2.7.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.
CWE-115	The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.

Attack-Flow Graph

Executive Summary

This vulnerability in OpenVPN versions 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified. It occurs because the system ignores the configured X.509 username identity lookup field, potentially leading to incorrect user identification during authentication.

Detection Guidance

This vulnerability involves OpenVPN with mbedTLS misidentifying users by ignoring X.509 username identity lookup. Detection requires checking OpenVPN server configurations for the 'username-as-common-name' or 'x509-username-field' settings. Inspect logs for authentication anomalies or misrouted sessions.

Impact Analysis

This vulnerability could allow attackers to bypass authentication checks by exploiting the misidentification issue. It may lead to unauthorized access to VPN resources or data, compromising confidentiality and integrity of communications for affected users.

Compliance Impact

This vulnerability could impact compliance by potentially allowing unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected OpenVPN versions may face compliance violations and increased risk of data breaches.

Mitigation Strategies

Upgrade OpenVPN to a version beyond 2.7.5 to address the X.509 username identity lookup issue. Review and enforce strict X.509 certificate validation policies to prevent misidentification of remote authenticated users.

Hi! I’m here to help you understand CVE-2026-63650. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70