by Kastro
Paper/Archive/CVE-2026-41070

CVE-2026-41070

jkroepke openvpn-auth-oauth2 — openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access

EPSS 0.4%CVSS 10.0
critical.is priorityof 100
38
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 38.1.381 × 207.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients that do not support WebAuth/SSO (e.g., the openvpn CLI on Linux) are incorrectly admitted to the VPN despite being denied by the authentication logic. The default management-interface mode is not affected because it does not use the OpenVPN plugin return-code mechanism. This issue has been patched in version 1.27.3.

Affected

ProductAffectedFixed inSource
openvpn-auth-oauth2>= 1.26.3, < 1.27.3–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgithub.com/jkroepke/openvpn-auth-oauth2/security/advisories/GHSA-246w-jgmq-88fgrefgithub.com/jkroepke/openvpn-auth-oauth2/commit/36f69a6c67c1054da7cbfa04ced3f0555127c8f2