CVE-2026-55706

Name of the Vulnerable Software and Affected Versions OpenBSD versions prior to 7.6

Description An authentication bypass exists in the sppp pap input function within sys/net/if spppsubr.c. The issue occurs when a PAP Auth-Request is sent with name len and passwd len set to zero. Because the system only checked these lengths against a maximum limit and then passed them to bcmp(), a length of zero caused bcmp() to return zero regardless of the actual content, allowing the credential check to be satisfied. This path is reachable over PPPoE via pppoe data input, pppoeintr, and sppp input. Additionally, the lack of a lower-bound test can lead to a kernel heap over-read if name len exceeds the allocated credential buffer. Real-world offensive activities targeting this issue have been identified.

Recommendations Update OpenBSD to version 7.6 or later.