The vulnerability allows an attacker to bypass extended key usage restrictions in the certificate validation process. This flaw means that a forged or otherwise invalid certificate could be accepted by the OpenVPN 3 Core Library, potentially enabling impersonation or unauthorized connections to a VPN server.

OpenVPN 3 Core Library versions 3.4 through 3.11.7 are affected. Users running any of these releases should verify the installed version.

The CVSS score of 6.3 indicates a moderate risk, and while the EPSS score is not available, the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a network-based exploitation where an attacker presents a certificate that does not meet the expected extended key usage constraints, potentially during the TLS handshake. Exploitation therefore would require sending crafted certificate data to a vulnerable OpenVPN instance.