CVE Intelligence
Analysis AI-assisted

CVE-2026-41070: openvpn-auth-oauth2 Improper Authentication in Experimental Plugin Mode

CVE-2026-41070 is an improper authentication flaw in openvpn-auth-oauth2 affecting versions from 1.26.3 up to, but not including, 1.27.3, only when the component runs in the experimental plugin mode. Clients without WebAuth/SSO support can be admitted to the VPN even when the authentication logic denies them. The CVSS 3.1 score of 10.0 comes from the GitHub CNA, and the record states the issue is fixed in 1.27.3.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-41070 affects openvpn-auth-oauth2, a client that connects OpenVPN servers to OIDC-based single sign-on. According to the record, the flaw appears only in the experimental plugin mode, where OpenVPN relies on the plugin return code to decide whether to admit a connection.

Impact

  • Clients that do not support WebAuth/SSO can be admitted to the VPN even when the authentication logic denies them.
  • The CVSS 3.1 vector reported by the GitHub CNA lists network attack vector, no privileges, no user interaction, scope change, and high confidentiality and integrity impact. Availability impact is listed as none.
  • The weakness is classified as CWE-287, Improper Authentication.

Affected products and versions

  • openvpn-auth-oauth2 from 1.26.3 up to, but not including, 1.27.3, only when deployed in the experimental plugin mode.
  • The default management-interface mode is stated not to be affected.
  • The structured affected and fixes fields in the record are empty, so the version range is taken from the description text.

Exploitation status

The record shows that this CVE is not listed in the CISA KEV catalog. No confirmed active exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Upgrade to openvpn-auth-oauth2 1.27.3 or later, as stated in the record.
  • If an upgrade cannot be applied immediately, check whether the experimental plugin mode is in use. Where compatible with your deployment, consider the default management-interface mode, which the description says is not affected. Validate any change in a test environment first.
  • Read the GitHub security advisory and the referenced commit for maintainer details.

Detection guidance

  • Review OpenVPN server logs for sessions established by clients that did not complete the SSO flow.
  • Check server configuration for the plugin directive that loads the openvpn-auth-oauth2 shared library.
  • Compare successful VPN connections with identity provider login records to find sessions without a matching SSO authentication.

Limitations of the available information

  • The record has no structured affected or fixed version data and no NVD-assigned CVSS score in the provided fields; only one CVSS 3.1 score from the GitHub CNA is listed.
  • The record does not describe real-world incidents, affected deployment counts, or the exact conditions under which the flaw was discovered.
  • EPSS values are present in the record, but this analysis does not use them to infer exploitation.

Frequently asked questions

Which deployments are affected by CVE-2026-41070?

According to the record, only deployments of openvpn-auth-oauth2 from 1.26.3 up to, but not including, 1.27.3 that use the experimental plugin mode are affected. The default management-interface mode is stated not to be affected.

Is there a fix for this vulnerability?

The record states that the issue has been patched in version 1.27.3. Upgrading to that version or later is the remediation指定 in the description.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.