EUVD-2026-37521Severity by source
AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Adjacent PPP-link reach (AV:A) and no auth (PR:N); a zero-length field is trivial to craft so AC:L versus NVD's AC:H; auth bypass yields authorized network access, giving scope change and high CIA.
Primary rating from Vendor (mitre).
CVSS VectorNVD
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
9DescriptionNVD
sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.
AnalysisAI
Authentication bypass in OpenBSD's sppp PAP handler (sppp_pap_input in sys/net/if_spppsubr.c) lets an adjacent attacker on a PPP link authenticate without valid credentials by supplying zero-length name/password fields, which the kernel only bounds-checked against an upper limit (AUTHMAXLEN) instead of the exact expected credential length. All OpenBSD builds before commit 076e2b1 that terminate PPP sessions with PAP authentication are affected. Publicly available exploit code exists (an Argus Systems PoC script) and a vendor fix is available, though EPSS is low (0.21%, 12th percentile) and the flaw is not in CISA KEV, so this is proof-of-concept rather than confirmed active exploitation.
Technical ContextAI
The bug lives in OpenBSD's synchronous/asynchronous PPP subsystem (sppp), which implements PAP (Password Authentication Protocol, RFC 1334) inside the kernel network stack. When a peer sends a PAP Authenticate-Request, sppp_pap_input parses a name field and a password field, each preceded by a length byte. The vulnerable code validated only that name_len and passwd_len did not exceed AUTHMAXLEN, never that they matched the length of the locally configured expected credential (sp->hisauth.name / sp->hisauth.secret). This is a classic CWE-1284 (Improper Validation of Specified Quantity in Input): with a length of zero, the subsequent comparison against the configured secret degenerates and the credential check passes, granting a successful PAP authentication. The fix (commit 076e2b1c1fc4ac0883a72d3544131ad5cee7adf8, revision 1.202) replaces the '> AUTHMAXLEN' bounds checks with strict equality checks 'name_len != strlen(sp->hisauth.name)' and 'passwd_len != strlen(sp->hisauth.secret)', rejecting any request whose field lengths do not exactly match the expected credential. The affected CPE is cpe:2.3:a:openbsd:openbsd, and reporting notes the logic error persisted for roughly 27 years.
RemediationAI
Apply the vendor fix by updating sys/net/if_spppsubr.c to revision 1.202 or later (commit 076e2b1c1fc4ac0883a72d3544131ad5cee7adf8) and rebuilding the kernel, or install an OpenBSD errata/syspatch or release build that incorporates it - this is the primary and complete remediation, since the patch enforces exact-length credential validation (see https://github.com/openbsd/src/commit/076e2b1c1fc4ac0883a72d3544131ad5cee7adf8 and the disclosure at https://www.openwall.com/lists/oss-security/2026/06/16/9). Because the released tagged patched build should be confirmed against OpenBSD errata, treat the commit as the authoritative fix reference. If you cannot patch immediately, the most effective compensating control is to avoid PAP: switch affected PPP links to CHAP authentication, which does not traverse the vulnerable sppp_pap_input path (trade-off: requires peer support and reconfiguration of both ends). Where PAP cannot be removed, restrict the PPP link to trusted physical/adjacent peers and place the concentrator behind link-layer access controls so untrusted parties cannot present PAP requests (trade-off: does not help against a malicious or spoofed peer already on the link). Disabling or removing sppp/PPP interfaces entirely eliminates exposure but breaks any dependent connectivity.
httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for
OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be
The OpenBSD qsort() function is recursive, and not randomized, an attacker can construct a pathological input array of N
NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers
iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for chec
libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ldapd, or radiu
Integer truncation error in the amap_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code
Integer overflow in the amap_alloc1 function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with ke
OpenBSD 6.6, in a non-default configuration where S/Key or YubiKey authentication is enabled, allows local users to beco
xlock in OpenBSD 6.6 allows local users to gain the privileges of the auth group by providing a LIBGL_DRIVERS_PATH envir
In OpenBSD 6.6, local users can use the su -L option to achieve any login class (often excluding root) because there is
The sys_thrsigdivert function in kern/kern_sig.c in the OpenBSD kernel 5.9 allows remote attackers to cause a denial of
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today