Authentication Bypass Vulnerability in OpenLiteSpeed by LiteSpeed Technologies
CVE-2026-119559

8.2HIGH

Key Information:

Vendor: Litespeedtech
Status: Openlitespeed
Vendor: CVE Published:; 30 October 2026

🔔 Create Litespeedtech Vulnerability Alert

What is CVE-2026-119559?

OpenLiteSpeed, up to version 1.9.4, contains an authentication bypass vulnerability that enables unauthenticated remote attackers to bypass virtual host client certificate requirements over HTTP/3. This flaw arises from the QuicStream's inheritence of the verifyContext() function, which always returns true, allowing attackers to exploit a non-mTLS host's SNI in conjunction with a protected Host header, thereby gaining unauthorized access to restricted content.