CVE-2026-86219

Name of the Vulnerable Software and Affected Versions Authen::SASL::Perl::DIGEST MD5 versions prior to 2.2100

Description An issue exists where the software accepts replayed authentication responses due to an unverified nonce in the server step() function. While server start() generates a fresh nonce for the challenge, the system fails to compare this value against the nonce returned by the client. Because server step() derives the expected digest from the client's own parameters, any response is verified as long as its digest matches the included nonce. Additionally, the count table is keyed on the client-supplied nonce and starts empty for each new server object, allowing a captured response with nc=00000001 to pass. An attacker observing a successful qop=auth exchange can replay the captured response in a later session for the same service, host, realm, and user to authenticate without the password.

Recommendations Update Authen::SASL::Perl::DIGEST MD5 to version 2.2100 or later.