CVE-2026-129483

CVSS 9.3 (critical) · published 2026-11-15

Cyrus SASL through 2.1.28 contains an authentication bypass vulnerability in the SRP server mechanism because srp_server_mech_step2 does not reject client public values A that are multiples of N. Unauthenticated network clients can send A equal to N to force a zero shared secret, authenticating as any existing user without the password and learning session keys.

Weakness: CWE-287

Source: NVD CVE-2026-129483

References

• https://gist.github.com/afldl/18d15d3f5a1df99411e35000c7de80db
• https://github.com/cyrusimap/cyrus-sasl/blob/cyrus-sasl-2.1.28/plugins/srp.c#L2046-L2050
• https://github.com/cyrusimap/cyrus-sasl/commit/fb3724f43dc50247ff2bf02135457d6d77031654
• https://github.com/cyrusimap/cyrus-sasl/issues/896
• https://seclists.org/oss-sec/2026/q4/122
• https://www.vulncheck.com/advisories/cyrus-sasl-through-2.1.28-srp-authentication-bypass-via-plugins-srp-c

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.