CVE-2026-86219 Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step.

What is CVE-2026-86219?

CVE-2026-86219 is a critical authentication bypass vulnerability in perl-Authen-SASL, published on 6 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step.

server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client's own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge.

An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.

Weakness: CWE-294

Which versions are affected by CVE-2026-86219?

How do I fix CVE-2026-86219?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-86219 being exploited?

There is no known exploitation of CVE-2026-86219 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2026-86219, DEBIAN-CVE-2026-86219, GHSA-w4h4-7ff5-56xr, MGASA-2026-0400, OESA-2026-3775, OESA-2026-3776 and 10 more.