CVE-2026-119559 in OpenLiteSpeed
Summary
by MITRE • 10/30/2026
OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host's SNI with a protected Host header to access protected content.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in OpenLiteSpeed versions through 1.9.4 represents a critical authentication bypass mechanism within the HTTP/3 protocol stack, specifically leveraging flaws in how virtual host client certificate requirements are enforced during QUIC connections. This flaw allows unauthenticated remote attackers to circumvent security controls that mandate mutual Transport Layer Security (mTLS) for specific virtual hosts. The root cause lies in the implementation of the QuicStream class, which inherits a verifyContext method from its parent or base classes. In this inherited implementation, the verification logic is hardcoded to always return true regardless of whether valid client certificates are presented by the connecting party. This design oversight effectively nullifies the certificate validation process for HTTP/3 traffic, creating a significant gap in access control mechanisms that rely on mutual authentication to restrict entry to sensitive resources.
From an operational perspective, this vulnerability enables attackers to exploit the Server Name Indication field and the Host header to manipulate virtual host routing while bypassing security checks. By presenting a non-mTLS configured server name indication alongside a protected Host header, an attacker can trick the web server into serving content intended for strictly authenticated users without providing any credentials or certificates. This behavior undermines the fundamental assumption that HTTP/3 connections adhere to the same rigorous authentication standards as traditional HTTPS/TLS connections. The ability to access protected content without authorization poses severe risks to data confidentiality and integrity, potentially leading to unauthorized disclosure of sensitive information, privilege escalation within application contexts, and a complete compromise of the security posture for services relying on client certificate verification for identity management.
This vulnerability aligns with CWE-287, which describes Improper Authentication, as the system fails to adequately verify the identity of users or systems attempting to access resources. Furthermore, it relates to CWE-345, Insufficient Verification of Data Authenticity, because the server accepts connections without validating the expected cryptographic proofs associated with mTLS requirements. In terms of adversary tactics, this flaw facilitates initial access and lateral movement within a network by allowing attackers to bypass perimeter defenses that depend on certificate-based authentication. It can be categorized under ATT&CK technique T1078, Valid Accounts, as it allows unauthorized entities to operate as if they were authenticated users, thereby gaining persistent or temporary access to restricted areas of the application infrastructure without detection through standard credential monitoring systems.
Mitigation strategies must prioritize immediate patching to version 1.9.5 or later where this inheritance flaw has been corrected and proper certificate verification logic is enforced for HTTP/3 streams. In environments where upgrading is not immediately feasible, administrators should consider disabling HTTP/3 support entirely if the protocol is not strictly required, thereby removing the attack surface associated with QuicStream processing. Additionally, implementing strict network-level controls such as firewall rules or Web Application Firewalls that inspect and validate TLS handshake parameters before they reach the application layer can provide a compensating control. It is also advisable to review virtual host configurations to ensure that critical services do not rely solely on client certificates for protection without additional layers of authentication, thereby reducing the impact if similar vulnerabilities are discovered in other protocol implementations or future versions.