OpenLiteSpeed through 1.9.4 contains an authentication bypass flaw that allows an unauthenticated attacker to bypass client certificate requirements for virtual hosts when using HTTP/3. The flaw arises because QuicStream's verifyContext implementation always returns true, permitting a non‑mTLS host’s SNI combined with a protected Host header in a single request. The attacker can then access content that normally requires mutual TLS authentication.

Any installation of OpenLiteSpeed up to version 1.9.4 is affected. Deployments that enable HTTP/3 and rely on mTLS for virtual host protection are at risk, as do all virtual hosts configured to require client certificates.

The CVSS score of 8.2 indicates high severity, and the EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers need remote access to the server via HTTP/3 and the ability to craft a request that mixes a non‑mTLS host’s SNI with a protected Host header, which can be achieved by anyone who can reach the host over the internet. Consequently, this is a high‑risk authentication bypass that can grant unauthorized access to protected content.