CVE-2026-91769

Received Received - Intake

PHP OpenSSL Peer Verification Certificate Spoofing

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: PHP Group

Description

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-25

Generated

2026-09-26

AI Q&A

2026-09-26

EPSS Evaluated

N/A

NVD

CVE-2026-91769

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-297	The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

Executive Summary

This vulnerability involves PHP's OpenSSL stream peer verification. When verifying a certificate, PHP first checks the Subject Alternative Name (SAN) entries. If none match, it falls back to the Common Name (CN). However, RFC 6125 requires ignoring the CN if the certificate has any service identity. A certificate with a non-matching DNS SAN but a matching CN was still accepted, allowing a trusted certificate for one name to impersonate another.

Impact Analysis

An attacker could exploit this to impersonate a trusted service by using a certificate that matches the CN but not the SAN. This could lead to man-in-the-middle attacks, unauthorized access, or data interception if the service relies on certificate verification for authentication.

Compliance Impact

This vulnerability weakens authentication mechanisms, potentially violating requirements for secure communication and data protection in GDPR and HIPAA. Non-compliance could arise if the vulnerability leads to unauthorized access or data breaches, as it undermines secure certificate validation.

Mitigation Strategies

Update PHP to the latest version that includes a fix for this OpenSSL peer verification issue. Review and update SSL/TLS certificates to ensure they comply with RFC 6125 by including correct subjectAltName entries. Disable fallback to Common Name for certificate verification if possible.

Hi! I’m here to help you understand CVE-2026-91769. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70