ThreatCluster

27-Year-Old OpenBSD Vulnerability Exposed: Remote Auth Bypass Disclosed

First seen 17 Jun 2026, 17:10 UTC • •73

Article Content

1 / 4

Browse articles

ThreatCluster •June 18, 2026 at 16:45 UTC

•A critical vulnerability in OpenBSD's PAP authentication has existed for 27 years.
•Attackers can bypass authentication and intercept PPPoE traffic without credentials.
•OpenBSD has released a patch to address the vulnerability, urging immediate application.

A vulnerability in OpenBSD's networking stack has been disclosed, allowing attackers to bypass PAP authentication due to a logic flaw in the sppp_pap_input() function. This flaw, present since the import from FreeBSD in July 1999, enables attackers to intercept and read PPPoE traffic without credentials. The vulnerability affects systems relying on the Password Authentication Protocol (PAP) during the authentication phase. OpenBSD has released a patch to address this issue. The vulnerability has persisted through nearly three decades of system updates. Argus-Systems discovered the flaw, which is now classified as a critical security risk. Users of OpenBSD are urged to apply the patch immediately to mitigate potential exploitation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 114d ago How this analysis works

Timeline

1999-07-01

OpenBSD imports PPP stack from FreeBSD

The logic flaw in the sppp_pap_input() function was introduced during this import, leading to a long-standing vulnerability.

2026-06-16

Vulnerability disclosed

Argus-Systems revealed a remote authentication bypass in OpenBSD's kernel PPP stack, allowing credential-free access.

2026-06-17

Patch released by OpenBSD

OpenBSD released a patch to fix the vulnerability, urging users to apply it immediately to prevent exploitation.

Cybersecuritynews

More articles in this cluster (3)

Threat Graph

4 entities, 3 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (1)

Man-in-the-Middle

Weakness (1)

CWE-287 - Improper Authentication

Affected Platform (2)

FreeBSD
OpenBSD

Relationships

Man-in-the-Middle targets FreeBSD
Man-in-the-Middle targets OpenBSD
Man-in-the-Middle related to CWE-287 - Improper Authentication

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…