CVE-2014-9104: Multiple cross-site request forgery (CSRF) vulnerabilities in the XML-RPC API in the Desktop Client in Open...

Security readout for executives and security teams

This CVE affects legacy OpenVPN Access Server Desktop Client versions 1.5.6 and earlier. A malicious website could abuse an authenticated administrator's client session to perform sensitive actions, including creating VPN profiles that execute commands. The sources do not provide CVSS scoring or evidence of active exploitation. Likely exposure is limited to organizations still using OpenVPN Access Server Desktop Client 1.5.6 or earlier, especially on administrator workstations. The source bundle does not identify broader affected products or current supported-version status. Treat as high priority only if the legacy Desktop Client is still deployed. The business risk is administrator-assisted compromise of VPN client behavior and possible command execution; otherwise this is primarily a historical exposure to document and retire. Mitigation focus: Identify any OpenVPN Access Server Desktop Client 1.5.6 or earlier installations.; Check OpenVPN security advisories for fixed versions or migration guidance.; Remove or replace unsupported affected clients where vendor guidance is unavailable..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.