Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitylow

CVE-2026-86219: Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

oss-security ()3 · 1 read
Read at seclists.org
AI summary · glm-5.3-flashSummaries by Vani AI

Authen::SASL::Perl::DIGEST_MD5 before 2.2100 for Perl accepts replayed DIGEST-MD5 authentication responses via unverified nonce handling (CVE-2026-86219).

CVE-2026-86219 affects Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl. The server_step function does not verify the nonce, allowing replayed authentication responses to be accepted in DIGEST-MD5 SASL exchanges. The fix is available in version 2.2100 of the perl-authen-sasl distribution.

Key facts
  • Unverified nonce in server_step permits response replay
  • Fixed in Authen::SASL 2.2100
  • Affects legacy DIGEST-MD5 SASL mechanism deployments
  • Reported to oss-security by Timothy Legge
Analyze CVE-2026-86219 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-86219
Tags
authenticationdigest-md5perlreplay-attacksasl
Vendors
Authen::SASLperl-authen-sasl
Products
Authen::SASL::Perl::DIGEST_MD5

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-86219
Authentication Replay Bypass in Authen::SASL::Perl::DIGEST_MD5
9.8<1%

From the original article

Posted by Timothy Legge on Sep 06 ======================================================================== https://metacpan. org/dist/Authen-SASL https://github. com/perl-authen-sasl/perl-authen-sasl...

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.