CVE-2026-63650

OpenVPN versions 2.7_alpha1 through 2.7.5 using mbedTLS are vulnerable to a misidentification issue, where remote authenticated users can bypass the configured X.509 username identity lookup field. This flaw could lead to unauthorized access or privilege escalation, as users may be incorrectly identified. Organizations utilizing these OpenVPN versions should prioritize remediation to mitigate potential security risks.