CVE-2026-55706 Details
Description
sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.
A vulnerability allowing authentication bypass has been identified in the OpenBSD PPP (Point-to-Point Protocol) implementation, specifically within the PAP (Password Authentication Protocol) handling of the PPPoE (PPP over Ethernet) subsystem. This issue affects OpenBSD versions prior to the current release and was introduced in 1999. The vulnerability arises because the 'sppp_pap_input' function uses attacker-controlled length fields from incoming PAP frames to validate credentials. When both the name and password lengths are set to zero, the comparison function 'bcmp' incorrectly indicates a successful match, bypassing authentication entirely. Additionally, this flaw can be exploited to read beyond allocated memory, causing a kernel heap over-read.
Users can upgrade to the latest OpenBSD version, where this vulnerability has been fixed. The specific commit addressing this issue is available on the OpenBSD GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.argus-systems.ai/blog/poc-001-pap-bypass.py | CISA-ADP | Exploit |
| https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html | [email protected] | Third Party AdvisoryExploit |
| https://github.com/openbsd/src/commit/076e2b1c1fc4ac0883a72d3544131ad5cee7adf8 | [email protected] | Patch |
| https://www.openwall.com/lists/oss-security/2026/06/16/9 | [email protected] | ExploitMailing ListPatchThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1284 | Improper Validation of Specified Quantity in Input | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| openbsd openbsd | <= 7.6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 13, 2026 | Initial Analysis | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | New CVE Received | [email protected] |