Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-86219: libauthen-sasl-perl lets attackers replay login

CVE-2026-86219 · published 1 month ago

Summary

The Perl SASL authentication library (libauthen-sasl-perl) does not correctly verify a one‑time token when users log in, so a captured login response can be reused. An attacker who sees a single successful login can replay that information later and gain access to the same account without knowing the password. Update the library to the latest version or apply the vendor's patch to fix the verification logic.

What to do

Update debian libauthen-sasl-perl to version 2.2000-2.
Update libauthen-sasl-perl to version 2.1600-3.aikido.1.
Update rootio-libauthen-sasl-perl to version 2.1600-3.aikido.1.
Update bellsoft perl-authen-sasl to version 2.2100-r0.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	libauthen-sasl-perl	All versions
Ubuntu:14.04:LTS	canonical	libauthen-sasl-perl	All versions
Debian:14	debian	libauthen-sasl-perl	< 2.2000-2 Fix: upgrade to 2.2000-2
Root:Debian:12	–	libauthen-sasl-perl	< 2.1600-3.aikido.1 Fix: upgrade to 2.1600-3.aikido.1
Root:Debian:12	–	rootio-libauthen-sasl-perl	< 2.1600-3.aikido.1 Fix: upgrade to 2.1600-3.aikido.1
Alpaquita:stream	bellsoft	perl-authen-sasl	>= 2.16-r3, < 2.2100-r0 Fix: upgrade to 2.2100-r0

Original advisory text

BELL-CVE-2026-86219

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client's own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge. An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.

References

https://datatracker.ietf.org/doc/html/rfc2831#section-2.1.2 URL
https://www.cve.org/CVERecord?id=CVE-2025-40918 URL
https://security-tracker.debian.org/tracker/CVE-2026-86219 Vendor Advisory
https://metacpan.org/release/EHUELS/Authen-SASL-2.2000/source/lib/Authen/SASL/Pe... URL
https://nvd.nist.gov/vuln/detail/CVE-2026-86219 Vendor Advisory
https://github.com/perl-authen-sasl/perl-authen-sasl/commit/94337367030612842924... Patch
https://ubuntu.com/security/CVE-2026-86219 Third Party Advisory
https://cpan.org/modules URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/86xxx/CVE-2026-86219... Vendor Advisory
https://metacpan.org/release/EHUELS/Authen-SASL-2.2100/changes Vendor Advisory
https://metacpan.org/release/EHUELS/Authen-SASL-2.2000/source/lib/Authen/SASL/Pe... URL
https://github.com/perl-authen-sasl/perl-authen-sasl Product
https://www.cve.org/CVERecord?id=CVE-2026-86219 Third Party Advisory
https://lists.security.metacpan.org/cve-announce/msg/43326063/ Third Party Advisory
https://docs.bell-sw.com/security/cves/CVE-2026-86219 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker full control

Severity

9.8 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-294Authentication Bypass by Capture-replay

Timeline

Published8 Sep 2026

Updated11 Oct 2026

First seen6 Sep 2026

Sources

CVE-2026-86219 · NVD

CVE-2026-86219 · MITRE

DEBIAN-CVE-2026-86219 · OSV

UBUNTU-CVE-2026-86219 · OSV

CVE-2026-86219 · OSV

ROOT-OS-DEBIAN-12-CVE-2026-86219 · OSV

BELL-CVE-2026-86219 · OSV

Track software like this

Free during beta