Threats tagged 'ghsa-75rw-wm76-93p4'

OpenLiteSpeed versions through 1.9.4 have an authentication bypass vulnerability affecting HTTP/3 connections. This flaw allows unauthenticated remote attackers to bypass virtual host client certificate requirements by exploiting the QuicStream's verifyContext() method, which incorrectly always returns true. Attackers can use a non-mTLS host's SNI combined with a protected Host header to access content that should be protected.