OpenVPN 2.7_alpha1 through 2.7.7 have a flaw that lets a remote authenticated user craft a certificate subject field to make the server treat them as a different user. The vulnerability stems from unexpected input values and improper authentication, allowing impersonation of other accounts. Impersonation can be used to gain unauthorized access or elevate privileges within the VPN network.

The affected products are OpenVPN for all platforms. Versions from 2.7_alpha1 up to and including 2.7.7 are vulnerable. Any deployment of these releases is impacted.

The flaw provides a high‑severity path to account impersonation with a CVSS score of 7.6. Its EPSS score is below 1%, indicating a low probability of exploitation at present, and it is not listed in the CISA KEV catalog. Exploitation requires the attacker to have valid credentials and internet access to connect to the OpenVPN server. Once the subject field is forged, the server accepts the certificate as belonging to the target user, enabling unauthorized access or privilege misuse.