The vulnerability lies in PHP’s OpenSSL stream peer verification routine, which first checks the certificate’s subjectAltName entries and, when none match, falls back to using the Common Name (CN). RFC 6125 states that the CN must be ignored once any service identity is present, so a certificate that contains a non‑matching DNS SAN but a matching CN is still accepted, allowing a trusted certificate for one name to be used to impersonate another.

Any PHP installation that relies on OpenSSL for stream peer verification is affected. The CVE does not list specific PHP versions or patches; it applies to all affected releases until a patch is applied.

This flaw gives an attacker the ability to present a certificate that will be accepted for a TLS host that it did not originally cover, effectively enabling impersonation of the target server. The CVSS score of 4.3 indicates low overall severity, and the EPSS score is not available, suggesting no widespread exploitation data. While this vulnerability is not listed in the CISA KEV catalog, it could be leveraged in targeted attacks that require a valid client‑trusted certificate.