7-Year

Gbhackers •Divya • June 17, 2026

A significant authentication flaw has been discovered in the PPP stack of OpenBSD, allowing attackers to bypass the Password Authentication Protocol (PAP) validation and gain unauthorized network access. Although this vulnerability was patched in June 2026, it originated from legacy code dating back to 1999, making it one of the longest-standing authentication bypass issues in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

27-Year-Old OpenBSD Vulnerability Exposed: Remote Auth Bypass Disclosed A vulnerability in OpenBSD's networking stack has been disclosed, allowing attackers to bypass PAP authentication due to a logic flaw in the sppp_pap_input() function. This flaw, present since the import from FreeBSD in July 1999, enables attackers to intercept and read PPPoE traffic without credentials. The vulnerability affects systems relying on the Password Authentication Protocol (PAP) during the authentication phase. OpenBSD has released a patch to address this issue. The vulnerability has persisted through nearly three decades of system updates. Argus-Systems discovered the flaw, which is now classified as a critical security risk. Users of OpenBSD are urged to apply the patch immediately to mitigate potential exploitation. 3 sources 73

7-Year

The full story

Extracted Entities

CWE Weaknesses (1)

Platforms (1)