Authentication Bypass Vulnerability in OpenVPN by OpenVPN Technologies
CVE-2026-63650

2LOW

Key Information:

Vendor

Openvpn
Status
Openvpn
Vendor
CVE Published:
14 August 2026

What is CVE-2026-63650?

This vulnerability in OpenVPN versions 2.7_alpha1 to 2.7.5 involves an authentication bypass due to misconfiguration in the mbedTLS library. When using X.509 certificates, remote authenticated users may be incorrectly identified, allowing unauthorized access. It is essential for users of affected versions to review their configuration settings and apply any available patches to mitigate potential risks.

Affected Version(s)

OpenVPN 2.7_alpha1 < 2.7.6

References

https://community.openvpn.net/Security%20Announcements/CV...
vendor-advisory
https://community.openvpn.net/ReleaseHistory#openvpn-276-...
release-notes

CVSS V4

Score:
2
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.