CVE-2026-119559: OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch

Published Oct 30, 2026

Updated

OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host's SNI with a protected Host header to access protected content.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:31 AM

Data Sourced

via MITRE·11:31 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this bypass?

Deployments using OpenLiteSpeed through 1.9.4 that serve HTTP/3 and enforce client-certificate requirements on a virtual host may be exposed when another non-mTLS host can be used for SNI.

What does an attacker need to exploit it?

The attacker needs network access to the affected service and does not need credentials or user interaction. They use HTTP/3 with the SNI of a non-mTLS host while sending a Host header for the client-certificate-protected virtual host.

Is a client certificate required to access the protected content through this issue?

No. The described flaw allows an unauthenticated remote attacker to evade the protected virtual host's client-certificate requirement under the affected HTTP/3 SNI and Host mismatch condition.

CVE-2026-119559: OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch

Event History

Frequently Asked Questions

Which deployments are exposed to this bypass?

What does an attacker need to exploit it?

Is a client certificate required to access the protected content through this issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this bypass?

What does an attacker need to exploit it?

Is a client certificate required to access the protected content through this issue?