# CVE-2026-63649 - mbedTLS backend ignores x509-username-field

OpenVPN 2.7 using the mbedTLS backend ignores the `--x509-username-field` configuration and always uses the certificate Common Name, which allows remote authenticated users to potentially be identified as the wrong user or receive incorrect configurations.

Affects versions 2.7_alpha1 through 2.7.5. This is fixed in version 2.7.6.

CVE Record: [CVE-2026-63650](https://www.cve.org/CVERecord?id=CVE-2026-63650)

Github:
* [OpenVPN/openvpn-private-issues#144](https://github.com/OpenVPN/openvpn-private-issues/issues/144)

Release notes:
* [openvpn-2.7.6](https://community.openvpn.net/ReleaseHistory#openvpn-276-released-5-august-2026)

Reported-By: 章鱼哥 (www.aipyaipy.com)