When an AMQP client dispatches a frame labeled as a SASL frame, Proton will treat it as a valid authentication attempt. The frame can carry normal AMQP payloads, causing the server to skip proper SASL authentication. Because no username is set in this scenario, the application may allow access before authentication is complete or could reject the session. This vulnerability thus creates a potential authentication bypass that could permit unauthorized actions or cause a denial of service, depending on how the application handles partially authenticated sessions.

Apache Qpid Proton C provided by the Apache Software Foundation. Versions up to and including 0.40.0 are affected. Users are advised to upgrade to 0.41.1 or newer.

The CVSS score and EPSS score are not published, and the vulnerability is not listed in the CISA KEV catalog. The attack likely requires network access to an AMQP endpoint, allowing an external actor to send crafted frames that masquerade as SASL frames. Because the flaw can bypass standard authentication workflows, the risk level is potentially high where the application trusts unauthenticated frames. Without a published severity metric, administrators should treat this vulnerability as significant and plan remediation promptly.