CVE-2025-58060 Details
Description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization: Basic ...` header, the password is not checked. This results in authentication bypass. Any configuration that allows an `AuthType` that is not `Basic` is affected. Version 2.4.13 fixes the issue.
An authentication bypass vulnerability has been identified in OpenPrinting CUPS versions prior to 2.4.13. When the 'AuthType' is set to anything other than 'Basic', CUPS fails to validate passwords if the request includes an 'Authorization: Basic' header. This issue arises because the password check is skipped for non-Basic authentication types, allowing unauthorized access. The vulnerability affects any configuration that permits an 'AuthType' other than 'Basic'.
Users can upgrade to CUPS version 2.4.13 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 11, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openprinting cups | < 2.4.13 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 4, 2025 | CVE Modified | CVE |
| Nov 3, 2025 | CVE Modified | CVE |
| Sep 19, 2025 | Initial Analysis | [email protected] |
| Sep 11, 2025 | New CVE Received | [email protected] |