CVE-2026-63650

LOW

CVE: CVE-2026-63650 - OpenVPN 2Sign in to save

CVSS

2.0

CVSS v4.0

EPSS

N/A

Exploit Prediction Score

Published

August 14, 2026

Exploitability

No EPSS data available

Description

OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field

Weaknesses

CWE-115CWE-295

Affected Packages

No package data available.

Aliases

CVE-2026-63650

Related references

Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).

https://community.openvpn.net/ReleaseHistory#openvpn-276-released-5-august-2026
https://community.openvpn.net/Security%20Announcements/CVE-2026-63650