CVE-2020-15077

Name of the Vulnerable Software and Affected Versions OpenVPN Access Server versions 2.8.7 and earlier

Description The issue allows remote attackers to bypass authentication and access control channel data on servers configured with deferred authentication. This can potentially be used to trigger further information leaks.

Recommendations For OpenVPN Access Server versions 2.8.7 and earlier, update to a version later than 2.8.7 to resolve the issue. As a temporary workaround, consider disabling deferred authentication on servers until a patch is available. Restrict access to control channel data to minimize the risk of exploitation.