CVE-2026-55706: OpenBSD SPPP PAP Authentication Bypass via Zero-Length Field Validation

Technical summary

The vulnerability exists in sys/net/if_spppsubr.c within OpenBSD's kernel network stack. The sppp_pap_input function fails to properly validate length fields during PAP authentication handshakes, permitting an adjacent attacker to craft malicious packets with zero or undersized length values that bypass credential verification. The flaw is classified as an improper input validation issue (CWE-1284) and affects the authentication protocol state machine. The fix involves stricter bounds checking on length parameters before processing authentication credentials.

Business impact

Organizations relying on OpenBSD systems for network access control, point-to-point links, or VPN termination may have their authentication mechanisms circumvented. An attacker with network adjacency can gain unauthorized access to protected resources without valid credentials. The impact spans confidential data exposure, unauthorized system modifications, and potential service disruption. For ISPs and enterprises using OpenBSD for dial-up, ISDN, or other serial-protocol-based services, this creates a direct authentication bypass risk.

Affected systems

OpenBSD releases prior to commit 076e2b1 are affected. Organizations running OpenBSD on systems utilizing SPPP-based authentication (such as dial-up servers, point-to-point links, or PPP-over-serial configurations) should verify their current version and patch status. The vulnerability does not affect other BSD variants or non-OpenBSD systems unless they have ported identical code.

Exploitability

The attack requires the attacker to be on the same physical network segment or able to transmit packets to the target's network interface (AV:A). Attack complexity is high, indicating that exploitation requires specific conditions or timing. No privileges are required from the attacker, and user interaction is not necessary. While the barrier to exploitation is moderately elevated, organizations with untrusted adjacent networks or insecure physical infrastructure should treat this as a near-term risk.

Remediation

Update OpenBSD to a version including or superseding commit 076e2b1. Verify patch eligibility by cross-referencing your current OpenBSD version against the official security advisory. In the interim, network segmentation to isolate PPP/SPPP endpoints from untrusted adjacent networks and disabling SPPP services where not required can reduce exposure. Organizations unable to patch immediately should implement access controls to restrict network adjacency to trusted sources only.

Patch guidance

Apply security updates from the OpenBSD project corresponding to commit 076e2b1 or later. Review the official OpenBSD errata and security advisories to confirm the patch version appropriate for your deployment. After patching, test PPP/SPPP authentication flows to ensure service continuity. Verify the fix by checking kernel version strings and, if available, reviewing the commit details in your deployed kernel source.

Detection guidance

Monitor for anomalous PAP authentication attempts with zero or malformed length fields. Examine kernel logs and authentication daemons for failed or suspicious authentication sequences originating from adjacent network interfaces. Network intrusion detection systems can flag PAP packets with truncated or inconsistent length values. Review SPPP state machine logs for unexpected transitions or failed credential validation. Organizations using netflow or packet capture on SPPP interfaces should inspect protocol-layer anomalies in authentication phase exchanges.

Why prioritize this

Although the CVSS score of 5.8 (MEDIUM) reflects the requirement for adjacent network access and high attack complexity, the core impact—authentication bypass—is functionally severe. Organizations with internet-facing PPP services, untrusted network segments, or high-assurance authentication requirements should prioritize patching. The absence of KEV listing does not diminish the direct threat to authentication integrity; this reflects maturity stage rather than actual risk. Prioritize based on the presence of SPPP services in your infrastructure and the trustworthiness of adjacent networks.

Risk score, explained

CVSS 3.1 score of 5.8 (MEDIUM) reflects: AV:A (attacker must be on adjacent network), AC:H (requires specific conditions), PR:N (no privileges needed), UI:N (no user interaction), S:C (scope is changed—authentication bypass affects downstream services), and low impact across confidentiality, integrity, and availability (C:L/I:L/A:L). The score appropriately weights the authentication bypass against the network proximity requirement. Organizations with high-sensitivity authentication use cases may warrant elevated internal risk ratings despite the baseline CVSS assessment.

Frequently asked questions