CVE-2026-63650

LowCVSS 2.0

Published: 14/08/2026(UTC)Updated: 17/08/2026(UTC)Translated: 15/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.36%

29th percentile - higher than 29% of all known CVEs

Summary

OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field.

Risk Assessment

Risk of user misidentification, potentially leading to unauthorized access or privilege escalation.

Recommendation

Upgrade OpenVPN to a patched version or adjust authentication configuration.

Original NVD description (English source)

OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field