Authen::SASL::Perl::DIGEST_MD5 up to 2.2099 DIGEST_MD5.pm server_step improper authentication

Summaryinfo

A vulnerability classified as critical was found in Authen::SASL::Perl::DIGEST_MD5 up to 2.2099. Affected by this vulnerability is the function server_step of the file lib/Authen/SASL/Perl/DIGEST_MD5.pm. Such manipulation leads to improper authentication. This vulnerability is documented as CVE-2026-86219. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Authen::SASL::Perl::DIGEST_MD5 up to 2.2099. Affected by this issue is the function server_step of the file lib/Authen/SASL/Perl/DIGEST_MD5.pm. The manipulation with an unknown input leads to a improper authentication vulnerability. Using CWE to declare the problem leads to CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client's own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge. An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.

The advisory is shared for download at metacpan.org. This vulnerability is handled as CVE-2026-86219 since 09/06/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 2.2100 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-72163). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Programming Language Software

Name

• Authen::SASL::Perl::DIGEST_MD5

Version

• 2.2099

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion