OpenLiteSpeed CVE-2026-119559

Exploitation requires an OpenLiteSpeed instance (≤1.9.4) that simultaneously hosts an mTLS-protected virtual host (one configured to require client certificates) and at least one non-mTLS virtual host, with HTTP/3/QUIC enabled on the listener. The attacker crafts a QUIC request whose TLS SNI matches the non-mTLS host while the HTTP Host header targets the certificate-protected host, exploiting QuicStream's inherited verifyContext() that unconditionally returns true. Limiting factors: the HTTP/3 path specifically must be in use (the flaw is tied to QuicStream, not the HTTP/1.1 or HTTP/2 paths), and the mixed mTLS/non-mTLS virtual-host configuration must exist on the same instance - a single-mode deployment offers no non-mTLS SNI to abuse. No end-user interaction or prior authentication is needed (PR:N/UI:N).

The CVSS 4.0 score of 8.2 (High) is driven by a network vector (AV:N), no privileges (PR:N) and no user interaction (UI:N) against a high confidentiality impact (VC:H), while integrity and availability are explicitly nil (VI:N/VA:N) - this is purely an access-to-protected-content bypass, not code execution. The score is tempered by AC:H and AT:P, meaning the attacker needs a specific, attacker-uncontrolled precondition: the same OpenLiteSpeed instance must serve both an mTLS-protected virtual host and a non-mTLS virtual host, with HTTP/3 enabled. No EPSS score was provided and the vulnerability is NOT in CISA KEV, so there is no evidence of active or widespread exploitation; exploitation status is best read as targeted/theoretical rather than opportunistic. The vuln.today decision label is 'this_week', indicating prompt but non-emergency remediation - consistent with the absence of KEV/EPSS signals. Conflict to note: PR:N (unauthenticated) is correct because the whole point is bypassing client-certificate authentication, but the confidentiality-only impact and the AC:H/AT:P configuration dependency make this a real priority mainly for the narrow population running HTTP/3 with mixed mTLS and non-mTLS vhosts, and a lower practical concern for everyone else.

An OpenLiteSpeed server (≤1.9.4) hosts a virtual host that requires client certificates (mTLS) alongside at least one non-mTLS virtual host, with HTTP/3 enabled. An unauthenticated remote attacker opens an HTTP/3 (QUIC) connection presenting the SNI of the non-mTLS host but a Host header pointing at the protected host; because QuicStream inherits a verifyContext() that always returns true, the client-certificate requirement is never enforced and the attacker reaches the protected content. A detailed technical analysis of the flaw is publicly available (abraxaslabs/VulnCheck), though no packaged working exploit is confirmed in the provided data.