{"affected":[{"defaultStatus":"unaffected","ecosystem":"github","packageName":"litespeedtech/openlitespeed","product":"openlitespeed","source":"CNA: VulnCheck","vendor":"litespeedtech","versions":[{"lessThanOrEqual":"1.9.4","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-119559","cwes":["CWE-295"],"description":"OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host's SNI with a protected Host header to access protected content.","epss":{"date":"2026-11-05","percentile":0.21634,"score":0.00289},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://abraxaslabs.tech/research/openlitespeed-h3-mtls-verifycontext"}],"kev":null,"metrics":[{"score":8.2,"severity":"high","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":5.9,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793915108355,"publishedAt":1793359868276,"references":[{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/litespeedtech/openlitespeed/blob/v1.9.4/src/http/httpsession.cpp#L1665-L1672"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/litespeedtech/openlitespeed/blob/v1.9.4/src/sslpp/hiocrypto.h#L49-L50"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/litespeedtech/openlitespeed/blob/v1.9.4/src/quic/quicstream.h#L33-L37"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://abraxaslabs.tech/research/openlitespeed-h3-mtls-verifycontext"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://github.com/litespeedtech/openlitespeed"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/openlitespeed-through-1.9.4-mtls-bypass-via-http-3-sni-and-host-mismatch"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://abraxaslabs.tech/research/openlitespeed-h3-mtls-verifycontext"}],"remediation":[],"revision":"c292c905ba8fcc766ae45db381f408b6ac4809a1920e919c7c84b8ddd74e3cd9","sources":[{"modifiedAt":1793915108355,"name":"CNA: VulnCheck","retrievedAt":1793916817058,"url":"https://www.cve.org/CVERecord?id=CVE-2026-119559"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793916817516,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-119559"}],"ssvc":{"assessedAt":1793914973138,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"OpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch","updatedAt":1793916817516}