EUVD-2026-58813
GHSA-f94x-h63g-g9m8
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
High complexity from required mbedTLS plus --x509-username-field combination; PR:L for certificate possession; scope changed as unauthorized VPN access exposes downstream network.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
AnalysisAI
Certificate validation bypass in OpenVPN 2.7 alpha series (mbedTLS builds) causes the --x509-username-field directive to unintentionally accept certificates that should be rejected, potentially granting unauthorized VPN network access. Only deployments running a 2.7 alpha or pre-release build compiled against mbedTLS and explicitly configured with --x509-username-field are exposed; OpenVPN 2.6.x stable series and OpenSSL-backend builds are not affected. The vendor characterizes this as a low-priority security finding; no public exploit has been identified at time of analysis and it is not listed in the CISA Known Exploited Vulnerabilities catalog.
Technical ContextAI
OpenVPN supports flexible certificate-based authentication via --x509-username-field, which maps arbitrary X.509 certificate fields (CN, emailAddress, SAN components, etc.) to VPN usernames for access-control enforcement. This feature is implemented separately for each TLS backend - OpenSSL and mbedTLS. CWE-115 (Misinterpretation of Input) indicates the mbedTLS code path incorrectly evaluates or compares the extracted field value, producing a permissive match under certain certificate structures issued by a cooperating or attacker-controlled CA. The EUVD-2026-58813 advisory confirms the affected scope as 'OpenVPN 2.7_alpha1 < 2.7.6', consistent with the v2.7.6 release notes published by the OpenVPN project at https://github.com/OpenVPN/openvpn/releases/tag/v2.7.6. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L/UI:A) encodes the high attack complexity and specific prerequisite conditions required for exploitation.
RemediationAI
Upgrade to OpenVPN v2.7.6, which patches this vulnerability, as confirmed by the vendor release notes at https://github.com/OpenVPN/openvpn/releases/tag/v2.7.6 and the security announcement at https://community.openvpn.net/Security%20Announcements/CVE-2026-63650. If an immediate upgrade is not operationally feasible, two compensating controls apply: first, switching from the mbedTLS backend to OpenSSL (if the build environment permits) eliminates the vulnerable code path entirely, though this requires a recompile and potential certificate re-validation; second, removing or disabling the --x509-username-field directive and reverting to standard CN-based authentication eliminates the vulnerable logic path without recompilation, at the cost of requiring CA and client certificate policy reconfiguration. Deployments already running OpenSSL or not using --x509-username-field require no remediation action.
Same weakness CWE-115 – Misinterpretation of Input
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today