CVE-2026-55706 | sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 07… | CVSS 5.8 MEDIUM

Description

sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.

CVE ID: CVE-2026-55706
State: PUBLISHED
Assigner: mitre
Reserved: 2026-06-17 00:53 UTC
Published: 2026-06-17 00:53 UTC
Last updated: 2026-06-17 14:33 UTC
Primary CWE: CWE-1284
CWE-1284 Improper Validation of Specified Quantity in Input
Vendor / Product: OpenBSD / OpenBSD
Sources: cve.org · NVD

5.8 MEDIUM CVSS 3.1

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

SSVC — CISA Coordinator

Affected products (1)

Vendor	Product	Platform	Versions
OpenBSD	OpenBSD	—	0 < 076e2b1c1fc4ac0883a72d3544131ad5cee7adf8

Weakness (CWE)

CWE	Source	Description
CWE-1284	cna	CWE-1284 Improper Validation of Specified Quantity in Input

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.8	MEDIUM	3.1	cna	CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

References (3)