Improper certificate validation in the profile option parser (KUParse) of the OpenVPN 3 Core library 3.4 through 3.11.7 allows man-in-the-middle attackers holding any certificate issued by the client's configured CA to impersonate the VPN server via a certificate lacking a serverAuth extended key usage, because `remote-cert-tls` from a client profile is silently discarded during configuration load.