CVE-2026-86219 in Authen::SASL::Perl::DIGEST_MD5
Summary
by MITRE • 09/06/2026
Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step.
server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client's own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge.
An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified in Authen::SASL::Perl versions prior to 2.2100 represents a critical failure in the implementation of the DIGEST-MD5 authentication mechanism defined by RFC 2831. This flaw specifically resides within the server-side processing logic, particularly affecting the interaction between the server_start and server_step methods during the challenge-response handshake. The core technical deficiency lies in the lack of nonce verification. In a secure DIGEST-MD5 implementation, the server generates a unique, random nonce value for each authentication session and includes it in the initial challenge sent to the client. The client must then include this exact same nonce within its response payload when computing the cryptographic digest. However, in the affected Perl module versions, while the server correctly generates and transmits a fresh nonce during the start phase, the subsequent step function fails to validate that the nonce provided by the client matches the one originally issued. Instead, the verification logic derives the expected digest solely from parameters supplied directly within the client's response packet itself.
This architectural oversight fundamentally undermines the security guarantees of the authentication protocol. Because the server does not cross-reference the incoming nonce against its own generated value, it effectively treats any validly formatted response as authentic provided that the internal consistency checks pass. Furthermore, the module employs a count table to track nonces and prevent replay attacks by ensuring each nonce is used only once. However, this countermeasure is rendered ineffective because the lookup key for this table is also derived from the client-supplied nonce rather than the server-generated one. Since the count table initializes as empty with every new server object instance, there are no prior records to conflict with a reused value. Consequently, an attacker who captures a single successful authentication exchange can extract the full response packet, including the nonces and counters used during that session.
The operational impact of this vulnerability is severe, enabling straightforward replay attacks against services relying on DIGEST-MD5 for SASL authentication over Perl-based infrastructure. An adversary positioned to observe network traffic between a client and server can capture one valid authentication sequence where quality of protection is set to auth. By retransmitting this captured response in a subsequent session targeting the same service, host realm, and user account, the attacker can successfully authenticate as that legitimate user without possessing their password or any shared secret material. This bypasses the primary purpose of DIGEST-MD5, which is to protect against plaintext credential interception by ensuring that passwords are never transmitted over the wire while still maintaining session integrity through nonces. The ability to replay credentials allows for unauthorized access, potential privilege escalation if the compromised account has elevated permissions, and further lateral movement within the network environment.
From a classification perspective, this vulnerability aligns with CWE-294, which describes authentication bypass by capture-replay of messages, as well as CWE-367, referring to time-of-check-time-of-use (TOCTOU) race conditions in that the server checks parameters provided by the attacker rather than state maintained securely on the server side. In terms of adversary tactics, this flaw facilitates techniques associated with MITM01 or credential replay within the ATT&CK framework, allowing attackers to leverage intercepted authentication data for persistent access without triggering typical password-based failure alerts. To mitigate this risk, organizations must immediately upgrade Authen::SASL::Perl to version 2.2100 or later where the server_step function has been patched to strictly verify that the nonce in the client response matches the nonce generated during server_start. Additionally, until an update is applied, administrators should consider disabling DIGEST-MD5 authentication for sensitive services and migrating to more robust mechanisms such as SCRAM-SHA-256 or Kerberos which have stronger protections against replay attacks built into their specifications. Network-level controls like TLS encryption can also help prevent the initial capture of credentials but do not fix the underlying protocol implementation flaw if traffic is decrypted at the application layer.