PT-2026-98288

CVE-2026-91769

Published

2026-09-24

Updated

2026-11-09

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions PHP (affected versions not specified)

Description OpenSSL stream peer verification incorrectly handles certificate validation by falling back to the Common Name (CN) when no entries in the subjectAltName (SAN) match. According to RFC 6125, the CN should be ignored if the certificate contains any service identity. This behavior allows a certificate trusted for one name to be used to impersonate another if the CN matches the requested peer name despite a non-matching DNS SAN.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Researchers

Vendors