# CVE-2026-119559: OpenLiteSpeed HTTP/3 authentication bypass in mTLS verification

Source: https://junglewise.ai/threats/cve-2026-119559-openlitespeed-through-1-9-4-contains-an-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119559 · Severity: medium · CVSS 5.9 · Published 2026-10-30

OpenLiteSpeed is a high-performance web server used to host websites and applications. An attacker can bypass client certificate authentication on HTTP/3 connections and access protected content that should require a valid certificate. This allows unauthenticated users to reach restricted virtual hosts and their data on servers configured with certificate-based access control.

Vendors: [LiteSpeed Technologies](https://junglewise.ai/threats/vendors/litespeed-technologies).

## Quick answers

**Is CVE-2026-119559 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119559 being exploited in the wild.

**How severe is CVE-2026-119559?** Medium severity, with a CVSS score of 5.9, published 30 October 2026.

**Which products and versions are affected?** LiteSpeed Technologies OpenLiteSpeed through 1.9.4.

**Is there a fix for CVE-2026-119559?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-119559 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-119559?** Check whether you run LiteSpeed Technologies OpenLiteSpeed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The QuicStream class in OpenLiteSpeed's HTTP/3 implementation inherits a verifyContext() method from HioCrypto that always returns true, failing to validate whether a connection matches the required client certificate for a protected virtual host. An unauthenticated remote attacker can exploit this by sending an HTTP/3 request with an SNI from an unprotected host and a Host header pointing to a protected vhost configured with clientVerify Require. The TCP/HTTP/2 code path correctly performs pointer-equality verification and rejects such requests, but HTTP/3 bypasses this check.

## Affected products

- LiteSpeed Technologies OpenLiteSpeed through 1.9.4

## Timeline

- 2026-10-12: disclosed
- 2026-10-30: advisory

## References

- [https://abraxaslabs.tech/research/openlitespeed-h3-mtls-verifycontext](https://abraxaslabs.tech/research/openlitespeed-h3-mtls-verifycontext)
- [https://github.com/litespeedtech/openlitespeed](https://github.com/litespeedtech/openlitespeed)

## Related threats

- [OpenLiteSpeed privilege escalation in update script](https://junglewise.ai/threats/cve-2026-104474-openlitespeed-before-1-9-3-contains-a-local-privilege-escalation)