CVE-2026-41070

{
  "id": "CVE-2026-41070",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-08T16:16:11.030",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients that do not support WebAuth/SSO (e.g., the openvpn CLI on Linux) are incorrectly admitted to the VPN despite being denied by the authentication logic. The default management-interface mode is not affected because it does not use the OpenVPN plugin return-code mechanism. This issue has been patched in version 1.27.3."
    },
    {
      "lang": "es",
      "value": "openvpn-auth-oauth2 es un plugin/cliente de interfaz de gestión para el servidor OpenVPN para manejar flujos de autenticación de inicio de sesión único (SSO) basados en OIDC. Desde la versión 1.26.3 hasta antes de la versión 1.27.3, cuando openvpn-auth-oauth2 se despliega en el modo de plugin experimental (biblioteca compartida cargada por OpenVPN a través de la directiva plugin), los clientes que no soportan WebAuth/SSO (por ejemplo, la CLI de openvpn en Linux) son admitidos incorrectamente a la VPN a pesar de ser denegados por la lógica de autenticación. El modo de interfaz de gestión predeterminado no se ve afectado porque no utiliza el mecanismo de código de retorno del plugin de OpenVPN. Este problema ha sido parcheado en la versión 1.27.3."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "jkroepke",
          "product": "openvpn-auth-oauth2",
          "versions": [
            {
              "version": ">= 1.26.3, < 1.27.3",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-08T16:05:27.096841Z",
          "id": "CVE-2026-41070",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/jkroepke/openvpn-auth-oauth2/commit/36f69a6c67c1054da7cbfa04ced3f0555127c8f2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/jkroepke/openvpn-auth-oauth2/security/advisories/GHSA-246w-jgmq-88fg",
      "source": "[email protected]"
    }
  ]
}