Vulnerability Intelligence Report
OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch
CVE-2026-119559
OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host's SNI with a protected Host header to access protected content.
No Active Exploit Signals
CVSS Base Score
8.2
HIGH
EPSS Probability:0.29%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-295 ↗Improper Certificate Validation
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| litespeedtech | openlitespeed | 0 <= 1.9.4 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
EPSS Score
0.289%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulnCheck · Bug Bounty Provider · USA |
| Reserved | 2026-10-30T10:53:29 |
| Published | 2026-10-30T11:31:08 |
| Patch Date | 2026-10-12 |
| Last Updated | 2026-11-05T21:45:08 |
Community Chatter & Buzz