CVE-2026-84790 - Remote identity/authentication bypass via embedded NUL in certificate subject field

OpenVPN allows remote authenticated users to impersonate others via a crafted certificate subject field.

OpenVPN version 2.6.0 through 2.7.7 are affected. This is fixed in version 2.7.8.

CVE Record: CVE-2026-84790

Github:

• OpenVPN/openvpn-private-issues#163

Release notes:

• openvpn-2.7.8

Reported-By: Vivek Parikh