Skip to main content

Authen::SASL EUVDEUVD-2026-72163

| CVE-2026-86219 CRITICAL
Authentication Bypass by Capture-replay (CWE-294)
2026-09-06 CPANSec GHSA-w4h4-7ff5-56xr
Suse
9.8
CVSS 3.1 · Vendor: CPANSec
Share

Severity by source

Vendor (CPANSec) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.4 HIGH

Replay requires first capturing a valid prior exchange (AC:H); no auth needed (PR:N); yields authentication as the user (C:H/I:H) but no availability impact (A:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from Vendor (CPANSec).

CVSS VectorVendor: CPANSec

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

7
Metadata Corrected
Sep 08, 2026 - 21:40 vuln.today
tag: Information Disclosure removed
Metadata Corrected
Sep 08, 2026 - 21:40 vuln.today
tag: Microsoft removed
Source Code Evidence Fetched
Sep 08, 2026 - 21:05 vuln.today
Analysis Generated
Sep 08, 2026 - 21:05 vuln.today
CVSS changed
Sep 08, 2026 - 19:23 NVD
9.8 (CRITICAL)
CVE Published
Sep 06, 2026 - 17:46 cve.org
CRITICAL 9.8
CVE Published
Sep 06, 2026 - 17:46 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step.

server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client's own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying nc=00000001, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge.

An attacker who observes one successful qop=auth exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.

AnalysisAI

Authentication bypass via response replay affects the DIGEST-MD5 server implementation in the Perl Authen::SASL distribution (Authen::SASL::Perl::DIGEST_MD5) before version 2.2100. The server generates a fresh nonce in its challenge but never compares it against the nonce returned by the client, so an attacker who passively captures one successful qop=auth exchange can replay that exact response against a later session for the same service, host, realm and user and authenticate as that user without knowing the password. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires the attacker to first observe and capture one complete successful DIGEST-MD5 qop=auth exchange (passive sniffing or a MITM position on an unencrypted or interceptable channel), and the replay target must be the same service, host, realm and username as the captured exchange. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) overstates the practical risk in two ways. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade to Authen::SASL 2.2100 or later, which adds the RFC 2831 nonce-equality check in server_step (Vendor-released patch: 2.2100; upstream fix commit 94337367030612842924f697cead29964a96448d). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems and applications running Perl Authen::SASL with DIGEST-MD5 enabled, particularly in production environments and systems handling sensitive inter-service authentication. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-294 – Authentication Bypass by Capture-replay

View all
CVE-2017-3191 CRITICAL
9.8
CVE-2026-62911 HIGH POC
8.0
CVE-2017-6823 HIGH POC
8.8
CVE-2023-1886 CRITICAL POC
9.8
CVE-2023-1537 CRITICAL POC
9.8
CVE-2022-29334 CRITICAL POC
9.8
CVE-2021-27289 CRITICAL POC
9.1
CVE-2022-31277 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

EUVD-2026-72163 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy