CVE-2026-91769
TLS Hostname Verification Falls Back to CN After SAN Mismatch
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN was still accepted when its CN matched the requested peer_name. A certificate trusted by the client for one name can therefore be used to impersonate another.
| CWE | CWE-297 |
| Vendor | php group |
| Product | php |
| Published | Sep 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for php group php
Be the first to know when new medium vulnerabilities affecting php group php are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Affected Versions
PHP Group / PHP
8.2.* < 8.2.34 8.3.* < 8.3.35 8.4.* < 8.4.26 8.5.* < 8.5.11
References
Credits
🔍 Cantina (https://www.cantina.security/) 🔍 David Korczynski Jakub Zelenka Arnaud Le Blanc Alexandre Daubois