Authentication Bypass in openvpn (CVE-2026-41070)
Summary
authentication bypass in openvpn (CVE-2026-41070). Confidential information can be exposed externally. Exploitable via plugin.
Original description
The description as published by the source.
openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients that do not support WebAuth/SSO (e.g., the openvpn CLI on Linux) are incorrectly admitted to the VPN despite being denied by the authentication logic. The default management-interface mode is not affected because it does not use the OpenVPN plugin return-code mechanism. This issue has been patched in version 1.27.3.
Source: NIST National Vulnerability Database NVD GitHub Advisory
AI summary
Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.
Companies using OpenVPN plugins may face authentication issues, allowing unauthorized access in certain versions (1.26.3 to 1.27.2). If this plugin is in use, update immediately to version 1.27.3 or switch to a non-plugin mode. Past incidents with similar issues have caused significant harm, necessitating prompt action.
This vulnerability occurs in the OpenVPN plugin, openvpn-auth-oauth2, in versions 1.26.3 to 1.27.2 when used in an experimental plugin mode. The issue arises when clients not supporting OIDC SSO (such as the Linux OpenVPN CLI) are mistakenly granted VPN access due to a bug where the plugin returns FUNC_SUCCESS instead of properly denying authentication. This allows unauthorized access. The fix is implemented in version 1.27.3, and switching to a management interface mode that does not use the plugin is a recommended workaround.
openvpn-auth-oauth2 plugin for OpenVPN incorrectly grants access to unauthenticated clients in experimental plugin mode.
In openvpn-auth-oauth2 versions 1.26.3 to 1.27.2, particularly in experimental plugin mode configurations.
Critical vulnerability allowing unauthorized VPN access due to incorrect authentication responses.
Upgrade to openvpn-auth-oauth2 version 1.27.3.
Switch to the management interface mode, which does not use the plugin, or restrict VPN access to clients supporting WebAuth/SSO.
Identify any OpenVPN servers using openvpn-auth-oauth2 in experimental plugin mode with affected versions, and assess logs for unauthorized VPN connections.
Related past incidents Similar incidents extracted from past CVEs
OpenVPN user bypass due to flawed authentication logic, leading to unauthorized access.
A serious OpenSSL vulnerability which enabled attackers to steal information from the server's memory.
Remote code execution vulnerability in Log4j allowing attackers to gain full server access, highlighting severe misconfiguration risks.
If this happens at your company Expected impact per business scenario
Unauthorized users could gain access to internal resources, leading to data breaches or exposure of sensitive information.
Developers may unknowingly connect to unsecured environments, risking project integrity and intellectual property loss.
Unsecured access could lead to unauthorized financial transactions, causing significant financial and reputational damage.
Immediately update the openvpn-auth-oauth2 plugin to version 1.27.3 or higher and audit current plugin modes to switch any affected setups to management interface mode.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'openvpn' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
openvpnを grep し、稼働しているサービス・バージョンを把握する。 -
2Match against affected range verify
Confirm if version satisfies `>= 1.26.3`Step 1 で見つかったバージョンが影響範囲
>= 1.26.3に該当するか照合。本番で稼働中ならインシデント扱い。 -
7Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番では Step 3 と同じログクエリでアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-41070 openvpn-auth-oauth2 Fixed in: 1.27.3-1
- Ubuntu UBUNTU-CVE-2026-41070 openvpn-auth-oauth2
References
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- patch github.com
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com