CVE-2026-119559

OpenLiteSpeed versions through 1.9.4 are vulnerable to an authentication bypass over HTTP/3 . The root cause is that the QuicStream component inherits a verifyContext() implementation that consistently returns true. This allows unauthenticated remote attackers to evade virtual host client certifi...