CVE-2022-0547

—

CVSS 3.1

9.8 critical

EPSS

4%p89

Published

Mar 18, 2022 (Mar 18, 2022)

Modified

Jun 17, 2026

Description

OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.

Vendors: openvpn fedoraproject debian
Products: openvpn, fedora, debian linux
Weakness: CWE-305, CWE-287
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.6%)

In the news0 stories

No ingested article mentions this CVE yet.