# CVE-2026-84790 - Remote identity/authentication bypass via embedded NUL in certificate subject field 

OpenVPN allows remote authenticated users to impersonate others via a crafted certificate subject field.

OpenVPN version 2.3.0 through 2.7.7 are affected. This is fixed in version 2.7.8.

CVE Record: [CVE-2026-84790](https://www.cve.org/CVERecord?id=CVE-2026-84790)

Github:
* [OpenVPN/openvpn-private-issues#163](https://github.com/OpenVPN/openvpn-private-issues/issues/163)

Release notes:
* [openvpn-2.7.8](https://community.openvpn.net/ReleaseHistory#openvpn-278-released-7-october-2026)

Reported-By: Vivek Parikh