CVE-2026-63650

OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...

CVE-2026-63650

OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...

CVE-2026-63650

OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...

CVE-2026-63650

OpenVPN 2.7_alpha1 through 2.7.5 with mbedTLS is affected by a misidentification issue where remote authenticated users can be misidentified due to ignoring the configured X.509 username identity lookup field. The vulnerability affects OpenVPN components from the specified 2.7 alpha to 2.7.5 rang...

CVE-2026-63650

OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...

CVE-2026-63649

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...

CVE-2026-63649

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...

CVE-2026-63649

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...

CVE-2026-63649

The CVE-2026-63649 entry affects the Windows interactive service in OpenVPN 2.4.0–2.6.21 and 2.7_alpha1–2.7.5, where local authenticated users can bypass the trusted configuration directory constraint and load arbitrary configuration files by crafting options that bypass whitelist checks. The und...

CVE-2026-63649

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...

EUVD-2026-58549

luci-app-openvpn fails to properly validate the instancename2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SS...

PT-2026-72123

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.4.0 through 2.6.21 OpenVPN versions 2.7 alpha1 through 2.7.5 Description The Windows interactive service allows local authenticated users to bypass the trusted configuration directory constraint. This is achieved by using...

CVE-2026-63649: Permissive List of Allowed Inputs

The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks...

CVE-2026-63650: Improper Certificate Validation

OpenVPN 2.7alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field...

PT-2026-72124

Name of the Vulnerable Software and Affected Versions OpenVPN versions 2.7 alpha1 through 2.7.5 Description When using mbedTLS, remote authenticated users can be misidentified because the system ignores the configured X.509 username identity lookup field. X.509 is a standard for public key...

CVE-2026-72841

luci-app-openvpn fails to properly validate the instancename2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SS...

CVE-2026-72841

luci-app-openvpn fails to properly validate the instancename2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SS...

CVE-2026-72841

The CVE-2026-72841 entry affects the OpenWrt luci-app-openvpn component. An insecure validation of the instance_name2 parameter during file upload lets authenticated users perform path traversal and write arbitrary files outside the intended directory. Attackers could place SSH keys in system dir...

CVE-2026-72841 luci-app-openvpn Path Traversal RCE via instance_name2

luci-app-openvpn fails to properly validate the instancename2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SS...

CVE-2026-72841 luci-app-openvpn Path Traversal RCE via instance_name2

luci-app-openvpn fails to properly validate the instancename2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SS...