EUVD-2026-90259
GHSA-f239-ggxr-g679
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (PR:N), but the fd+msgid reuse race makes it AC:H; binding as another identity yields C:H/I:H, while the NULL-deref crash is A:L.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)
AnalysisAI
Remote, unauthenticated attackers who can reach an explicitly enabled OpenBSD ldapd instance can complete an LDAP Bind as another identity because delegated BSD authentication results are correlated only by the LDAP child process's client file descriptor and LDAP message ID. When a connection closes and a later connection reuses the same file descriptor and message ID, the earlier successful authentication result is delivered to the new connection, granting the attacker the other user's identity (CWE-863, incorrect authorization); the same code path also dereferences a missing connection and crashes the daemon for denial of service. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that ldapd be explicitly enabled (it is NOT enabled by default on OpenBSD) and reachable by the attacker, and that it use delegated BSD authentication for Bind. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine authentication-bypass flaw (CWE-863) in OpenBSD's ldapd, confirmed by an upstream source-code fix and two errata (7.8/057, 7.9/021), so the technical defect is well-established rather than speculative. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: install OpenBSD 7.9 errata 021 (signed patch https://ftp.openbsd.org/pub/OpenBSD/patches/7.9/common/021_ldapd.patch.sig) or OpenBSD 7.8 errata 057, per https://www.openbsd.org/errata79.html and https://www.openbsd.org/errata78.html; on -stable these are applied automatically by syspatch, otherwise rebuild and reinstall the ldapd binary from an updated source tree containing commit 4f3f58e83c2a6d239c544236a9d4d76c74bbf960. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all OpenBSD systems for manually enabled ldapd instances and delegated BSD authentication configurations, and if the service is not business-critical, disable ldapd or delegated BSD authentication; restrict network access to ldapd to trusted management networks only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote serv
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or e
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today