Vulnerability

CVE-2026-91769

Descriptive record received from OpenCTI and minimised for consultation in the Intel portal.

Sharing: PUBLIC-OSINT
Confidence: 100
Source: The CVE Program
Updated: 26/09/2026 03:07

Description

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.

STIX identifiervulnerability--53a18128-b2d7-5d7b-a7fa-be666316d8d7

First observation-

Last observation-

Known relationships8

Aliases and classifications

CWE-297Improper Validation of Certificate with Host Mismatch

Minimised technical details

No raw data

cisa kev: False
cvss score: 4.3
cvss vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
cvss severity: MEDIUM

Provenance

Public references

vendor-advisory
https://github.com/php/php-src/security/advisories/GHSA-vvx9-73fr-5jjx

EudorIA correlation

Intel catalogue

The vulnerability is also available in the EudorIA editorial catalogue.

Open EudorIA analysis

Presence in OpenCTI describes an intelligence correlation and does not, by itself, constitute evidence of compromise, legal attribution or operational guidance applicable without context verification.