Description
OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host's SNI with a protected Host header to access protected content.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
litespeedtech openlitespeed
Default version status: unaffected
0 to ≤ 1.9.4affected
pkg:github/litespeedtech/openlitespeedReferences
- https://github.com/litespeedtech/openlitespeed/blob/v1.9.4/src/http/httpsession.cpp#L1665-L1672 ↗
- https://github.com/litespeedtech/openlitespeed/blob/v1.9.4/src/sslpp/hiocrypto.h#L49-L50 ↗
- https://github.com/litespeedtech/openlitespeed/blob/v1.9.4/src/quic/quicstream.h#L33-L37 ↗
- https://abraxaslabs.tech/research/openlitespeed-h3-mtls-verifycontext ↗
- https://github.com/litespeedtech/openlitespeed ↗
- https://www.vulncheck.com/advisories/openlitespeed-through-1.9.4-mtls-bypass-via-http-3-sni-and-host-mismatch ↗