# CVE-2026-91769: PHP OpenSSL stream peer verification certificate validation bypass

Source: https://junglewise.ai/threats/cve-2026-91769-php-s-openssl-stream-peer-verification-checks-the-certificate-s  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-91769 · Severity: medium · CVSS 4.3 · Published 2026-09-25

PHP's OpenSSL stream connection handler incorrectly accepts certificates with mismatched hostnames by falling back to the certificate's Common Name even when a Subject Alternative Name (SAN) is present. An attacker with a certificate for one hostname can impersonate a different hostname to PHP applications making HTTPS or TLS connections, potentially exposing sensitive data transmitted to the wrong server.

Technologies: [Php](https://junglewise.ai/threats/technologies/php-php). Vendors: [PHP](https://junglewise.ai/threats/vendors/php).

## Quick answers

**Is CVE-2026-91769 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-91769 being exploited in the wild.

**How severe is CVE-2026-91769?** Medium severity, with a CVSS score of 4.3, published 25 September 2026.

**Which products and versions are affected?** Php <8.2.34, <8.3.35, <8.4.26, <8.5.11.

**Is there a fix for CVE-2026-91769?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-91769 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2026-91769?** Check whether you run Php at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The php_openssl_apply_peer_verification_policy() function fails to follow RFC 6125, which requires suppressing Common Name matching once a certificate presents service identity via SAN. A certificate with CN=victim.test and SAN=attacker.test is accepted when connecting to victim.test, indicating the fallback to CN occurs despite SAN presence. The vulnerability affects all default peer name verification in streams including file_get_contents(), fopen(), and stream_socket_client() over https:// and tls://, and is fixed in PHP 8.2.34, 8.3.35, 8.4.26, and 8.5.11.

## Affected products

- PHP PHP <8.2.34, <8.3.35, <8.4.26, <8.5.11

## Timeline

- 2026-09-25: disclosed

## References

- [https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx](https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx)

## Related threats

- [PHP stream filter heap information leak with NUL bytes in line-break-chars](https://junglewise.ai/threats/cve-2026-92842-the-convert-base64-encode-convert-quoted-printable-encode-and)
- [PHP OpenSSL heap-buffer overflow in wildcard certificate name matching](https://junglewise.ai/threats/cve-2026-91767-php-openssl-matches-wildcard-name-in-ext-openssl-xp-ssl-c)
- [PHP HTTP stream wrapper credential leak on cross-origin redirect](https://junglewise.ai/threats/cve-2026-91766-when-the-http-stream-wrapper-follows-a-redirect-it-forwards-the)
- [PHP SOAP XML parser unbounded recursion denial of service](https://junglewise.ai/threats/cve-2026-91765-cleanup-xml-node-in-the-soap-xml-parser-recurses-once-per-xml)
- [PHP Phar TAR integer overflow in size parsing](https://junglewise.ai/threats/cve-2026-6103-phar-tar-number-parses-the-octal-size-field-of-a-tar-header-into-a)