Quick answers
- Is CVE-2026-63650 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-63650 being exploited in the wild.
- How severe is CVE-2026-63650?
- Informational severity, published 14 August 2026.
- Which products and versions are affected?
- Openvpn 2.7_alpha1 through 2.7.5 (mbedTLS backend).
- Is there a fix for CVE-2026-63650?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-63650 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-63650?
- Check whether you run Openvpn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authentication identity lookup bypass in OpenVPN's mbedTLS integration. When processing X.509 client certificates for authentication, the application fails to properly validate the configured username identity lookup field, allowing an authenticated attacker to spoof their identity. An attacker with valid VPN credentials can exploit this to impersonate other users whose credentials they do not possess. The attack requires prior network authentication and exploits a flaw in certificate identity validation logic. OpenVPN versions 2.7_alpha1 through 2.7.5 using mbedTLS are affected; patched versions should be available.
Affected products
- OpenVPN OpenVPN 2.7_alpha1 through 2.7.5 (mbedTLS backend)
Timeline
- 2026-08-14: disclosed