Log in Start free

Vulnerability · Published Sep 6, 2026 · Assigned by CPANSec

CVE-2026-86219Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

Critical 9.8

In plain English

A critical-severity security flaw in Authen-SASL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.5%top 59.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client's own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge. An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12libauthen-sasl-perlno fix listedDEBIAN-CVE-2026-86219
Debian:13libauthen-sasl-perlno fix listedDEBIAN-CVE-2026-86219
Debian:14libauthen-sasl-perl2.2000-2DEBIAN-CVE-2026-86219
Ubuntu:22.04:LTSlibauthen-sasl-perl2.1600-1.1ubuntu0.1UBUNTU-CVE-2026-86219
Ubuntu:22.04:LTSlibauthen-sasl-perl2.1600-1.1ubuntu0.1USN-8858-1
Ubuntu:24.04:LTSlibauthen-sasl-perl2.1700-1ubuntu0.1USN-8858-1
Ubuntu:24.04:LTSlibauthen-sasl-perl2.1700-1ubuntu0.1UBUNTU-CVE-2026-86219
Ubuntu:26.04:LTSlibauthen-sasl-perl2.2000-1ubuntu0.1USN-8858-1
Ubuntu:26.04:LTSlibauthen-sasl-perl2.2000-1ubuntu0.1UBUNTU-CVE-2026-86219
Ubuntu:26.10libauthen-sasl-perl2.2000-1ubuntu1UBUNTU-CVE-2026-86219

Affected products (as reported)

VendorProductVersions
Authen-SASL 0 – before 2.2100

Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References