# CVE-2026-55706: OpenBSD auth bypass and heap over-read in sppp_pap_input

Source: https://junglewise.ai/threats/cve-2026-55706-openbsd-auth-bypass-and-heap-over-read-in-sppp-pap-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-55706 · Severity: medium · CVSS 5.8 · Published 2026-06-17

A vulnerability in OpenBSD's networking stack allows an attacker to bypass password requirements when connecting via certain types of internet links (PPPoE). By sending specially crafted empty credentials, an attacker on the same local network can gain unauthorized access to the network link or trick the system into routing traffic through a malicious server. This flaw has existed in the system's code for 27 years and could lead to intercepted data or unauthorized network access.

Technologies: [Openbsd](https://junglewise.ai/threats/technologies/openbsd). Vendors: [OpenBSD](https://junglewise.ai/threats/vendors/openbsd).

## Quick answers

**Is CVE-2026-55706 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55706 being exploited in the wild.

**How severe is CVE-2026-55706?** Medium severity, with a CVSS score of 5.8, published 17 June 2026.

**Which products and versions are affected?** Openbsd before commit 076e2b1 (including version 7.6).

**Is there a fix for CVE-2026-55706?** A patch was published on 2026-06-14: Fix committed to OpenBSD source tree Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55706 attacked?** It is attacked from the adjacent network, in an operating system.

**Am I affected by CVE-2026-55706?** Check whether you run Openbsd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The sppp_pap_input function in OpenBSD's PPP implementation (sys/net/if_spppsubr.c) improperly validates the length of incoming Password Authentication Protocol (PAP) credentials. The code uses attacker-controlled length fields as the comparison length for bcmp() without verifying they match the actual stored credential length. An attacker can send zero-length name and password fields, causing bcmp() to return 0 (success) unconditionally, bypassing authentication. Additionally, providing a length larger than the stored credential causes a kernel heap over-read. The vulnerability is reachable via the PPPoE data path and requires the target to be configured as a PAP authenticator. A fix was committed on June 14, 2026, which implements exact-length checks before comparison.

## Affected products

- OpenBSD OpenBSD before commit 076e2b1 (including version 7.6)

## Timeline

- 1999-07-01: other: Vulnerable code imported into OpenBSD from FreeBSD
- 2026-06-12: disclosed: Reported to OpenBSD by Argus
- 2026-06-14: patched: Fix committed to OpenBSD source tree
- 2026-06-17: advisory: CVE published

## References

- [https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html](https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html)
- [https://github.com/openbsd/src/commit/076e2b1c1fc4ac0883a72d3544131ad5cee7adf8](https://github.com/openbsd/src/commit/076e2b1c1fc4ac0883a72d3544131ad5cee7adf8)
- [https://www.openwall.com/lists/oss-security/2026/06/16/9](https://www.openwall.com/lists/oss-security/2026/06/16/9)
- [https://blog.argus-systems.ai/blog/poc-001-pap-bypass.py](https://blog.argus-systems.ai/blog/poc-001-pap-bypass.py)

## Related threats

- [OpenBSD ldapd LDAP Bind authentication confusion attack](https://junglewise.ai/threats/cve-2026-103547-in-ldapd-in-openbsd-7-8-before-errata-057-and-7-9-before-errata)
- [OpenBSD TKIP MIC-failure countermeasure inverted comparison](https://junglewise.ai/threats/cve-2026-56101-openbsd-tkip-mic-failure-countermeasure-inverted-comparison)
- [OpenBSD use-after-free in System V semaphore implementation](https://junglewise.ai/threats/cve-2026-57589-openbsd-use-after-free-in-system-v-semaphore-implementation)
- [In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor…](https://junglewise.ai/threats/cve-2026-41285-in-openbsd-through-7-8-the-slaacd-and-rad-daemons-have-an)
- [FreeBSD and NetBSD file integrity bypass in mmap function](https://junglewise.ai/threats/cve-1999-0323-freebsd-and-netbsd-file-integrity-bypass-in-mmap-function)