# CVE-2026-63650: OpenVPN authentication identity lookup bypass in mbedTLS

Source: https://junglewise.ai/threats/cve-2026-63650-openvpn-authentication-identity-lookup-bypass-in-mbedtls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63650 · Severity: info · Published 2026-08-14

OpenVPN is a widely-deployed VPN service used to provide secure remote access to corporate networks. A flaw in versions 2.7_alpha1 through 2.7.5 using the mbedTLS encryption library allows already-authenticated remote users to be misidentified by bypassing the configured X.509 certificate username lookup field, potentially enabling unauthorized access to resources intended for different users.

Technologies: [Openvpn](https://junglewise.ai/threats/technologies/openvpn). Vendors: [Openvpn](https://junglewise.ai/threats/vendors/openvpn).

## Quick answers

**Is CVE-2026-63650 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63650 being exploited in the wild.

**How severe is CVE-2026-63650?** Informational severity, published 14 August 2026.

**Which products and versions are affected?** Openvpn 2.7_alpha1 through 2.7.5 (mbedTLS backend).

**Is there a fix for CVE-2026-63650?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-63650 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-63650?** Check whether you run Openvpn at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication identity lookup bypass in OpenVPN's mbedTLS integration. When processing X.509 client certificates for authentication, the application fails to properly validate the configured username identity lookup field, allowing an authenticated attacker to spoof their identity. An attacker with valid VPN credentials can exploit this to impersonate other users whose credentials they do not possess. The attack requires prior network authentication and exploits a flaw in certificate identity validation logic. OpenVPN versions 2.7_alpha1 through 2.7.5 using mbedTLS are affected; patched versions should be available.

## Affected products

- OpenVPN OpenVPN 2.7_alpha1 through 2.7.5 (mbedTLS backend)

## Timeline

- 2026-08-14: disclosed

## References

- [https://community.openvpn.net/ReleaseHistory](https://community.openvpn.net/ReleaseHistory)
- [https://community.openvpn.net/Security%20Announcements/CVE-2026-63650](https://community.openvpn.net/Security%20Announcements/CVE-2026-63650)

## Related threats

- [OpenVPN use-after-free in TLS session promotion or expiry](https://junglewise.ai/threats/cve-2026-84471-the-fix-for-was-incomplete-a-use-after-free-in-openvpn-2-6-0)
- [OpenVPN integer underflow in domain search options](https://junglewise.ai/threats/cve-2026-88964-an-integer-underflow-in-openvpn-version-2-7-alpha3-through-2-7-7)
- [OpenVPN identity impersonation via embedded NUL in certificate subject](https://junglewise.ai/threats/cve-2026-84790-openvpn-2-7-alpha1-through-2-7-7-allows-remote-authenticated)
- [OpenVPN ACK packet retransmission denial of service](https://junglewise.ai/threats/cve-2026-84732-openvpn-ack-packet-retransmission-denial-of-service)
- [OpenVPN argument parsing vulnerability on Windows](https://junglewise.ai/threats/cve-2026-84256-openvpn-argument-parsing-vulnerability-on-windows)