CVE-2026-91769

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-25

Last updated on: 2026-09-29

Assigner: PHP Group

Description

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-25

Last Modified

2026-09-29

Generated

2026-10-16

AI Q&A

2026-09-26

EPSS Evaluated

2026-10-14

NVD

CVE-2026-91769

Affected Vendors & Products

Vendor	Product	Version / Range
PHP	Group	PHP 8.2.*
PHP	Group	PHP 8.3.*
PHP	Group	PHP 8.4.*
PHP	Group	PHP 8.5.*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-297	The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

Executive Summary

This vulnerability involves PHP's OpenSSL stream peer verification. When verifying a certificate, PHP first checks the Subject Alternative Name (SAN) entries. If none match, it falls back to the Common Name (CN). However, RFC 6125 requires ignoring the CN if the certificate has any service identity. A certificate with a non-matching DNS SAN but a matching CN was still accepted, allowing a trusted certificate for one name to impersonate another.

Detection Guidance

This vulnerability involves improper certificate validation in PHP's OpenSSL streams. To detect it, inspect PHP applications using OpenSSL streams for certificate validation logic. Check if they rely solely on Common Name (CN) matching instead of Subject Alternative Name (SAN) entries. Use OpenSSL commands to verify certificate SANs: openssl x509 -in cert.pem -noout -text | grep -A1 'Subject Alternative Name'. Ensure applications validate SANs and reject certificates without matching SAN entries.

Impact Analysis

An attacker could exploit this to impersonate a trusted service by using a certificate that matches the CN but not the SAN. This could lead to man-in-the-middle attacks, unauthorized access, or data interception if the service relies on certificate verification for authentication.

Compliance Impact

This vulnerability weakens authentication mechanisms, potentially violating requirements for secure communication and data protection in GDPR and HIPAA. Non-compliance could arise if the vulnerability leads to unauthorized access or data breaches, as it undermines secure certificate validation.

Mitigation Strategies

Update PHP to the latest version that includes a fix for this OpenSSL peer verification issue. Review and update SSL/TLS certificates to ensure they comply with RFC 6125 by including correct subjectAltName entries. Disable fallback to Common Name for certificate verification if possible.

Hi! I’m here to help you understand CVE-2026-91769. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70