Search: CVE-2026-91769

CVE-2026-91769 is a vulnerability in PHP's OpenSSL stream peer verification where certificate validation incorrectly accepts certificates with a host name mismatch. Specifically, if a certificate includes subjectAltName (SAN) entries, PHP improperly falls back to validating the Common Name (CN) when no SAN matches, violating RFC 6125. This flaw allows a certificate trusted for one hostname to be used to impersonate another, potentially enabling man-in-the-middle attacks. The vulnerability has a medium severity with a CVSS score of 4.3. No affected versions or patch information are explicitly provided.