CVE-2026-119559

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext implementation that always returns true, attackers can present a...

CVE-2026-119559 OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext implementation that always returns true, attackers can present a...

EUVD-2026-113824

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext implementation that always returns true, attackers can present a...

CVE-2026-119559

OpenLiteSpeed versions through 1.9.4 are vulnerable to an authentication bypass over HTTP/3 . The root cause is that the QuicStream component inherits a verifyContext() implementation that consistently returns true. This allows unauthenticated remote attackers to evade virtual host client certifi...

PT-2026-133497

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext implementation that always returns true, attackers can present a...