High severity · published Jun 17, 2026
CVE-2026-55706
sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths
8.3
CVSS
0.4%
EPSS
No
On KEV
Description
sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
OpenBSD · OpenBSD
before 076e2b1c1fc4ac0883a72d3544131ad5cee7adf8 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-55706
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-55706
Third Party Advisory
https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html
Patch
https://github.com/openbsd/src/commit/076e2b1c1fc4ac0883a72d3544131ad5cee7adf8
Exploit
https://www.openwall.com/lists/oss-security/2026/06/16/9
Exploit
https://blog.argus-systems.ai/blog/poc-001-pap-bypass.py
More from OpenBSD
9.8
CVE-2024-10934
OpenBSD NFS double-free vulnerability
9.8
CVE-2024-29937
NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to…
9.8
CVE-2023-35784
A double free or use after free could occur after SSL_clear in OpenBSD 7.2 before errata 026 and 7.3 before errata 004, and in LibreSSL before 3.6.3 and 3.7.x before 3.7.3
9.8
CVE-2021-46880
x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverified certificate chain is sometimes…
9.8
CVE-2020-16088
iked in OpenIKED, as used in OpenBSD through 6.7, allows authentication bypass because ca.c has the wrong logic for checking whether a public key matches