27-Year

Cybersecuritynews •Abinaya • June 17, 2026

A long-standing vulnerability in OpenBSD’s networking stack has been disclosed, revealing that attackers can bypass PAP authentication entirely due to a decades-old logic flaw. The issue resides in the sppp_pap_input() function within OpenBSD’s sppp(4) subsystem, which manages synchronous PPP links used in PPPoE connectivity. During the PPP authentication phase, systems relying on the Password Authentication Protocol (PAP) validate user […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

27-Year-Old OpenBSD Vulnerability Exposed: Remote Auth Bypass Disclosed A vulnerability in OpenBSD's networking stack has been disclosed, allowing attackers to bypass PAP authentication due to a logic flaw in the sppp_pap_input() function. This flaw, present since the import from FreeBSD in July 1999, enables attackers to intercept and read PPPoE traffic without credentials. The vulnerability affects systems relying on the Password Authentication Protocol (PAP) during the authentication phase. OpenBSD has released a patch to address this issue. The vulnerability has persisted through nearly three decades of system updates. Argus-Systems discovered the flaw, which is now classified as a critical security risk. Users of OpenBSD are urged to apply the patch immediately to mitigate potential exploitation. 3 sources 73

27-Year

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)