Description
OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled
Published: 2026-07-06
Score: 5.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A malformed authentication token can trigger a reachable assertion in OpenVPN when the external-auth feature is enabled, causing the server process to crash. The crash terminates all VPN tunnel sessions, resulting in a loss of connectivity for all connected clients until the service restarts. The weakness corresponds to CWE‑617, reflecting improper input validation that leads to application failure.

Affected Systems

OpenVPN versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 are susceptible to this flaw. The vulnerability activates only when the external-auth option is enabled in the server configuration.

Risk and Exploitability

The CVSS score of 5.9 denotes moderate severity, and the EPSS score of less than 1 percent indicates a low probability of exploitation at present. The issue is not listed in the CISA KEV catalog. An attacker capable of forging a token can remotely exploit the flaw without requiring local privileges; exploitation requires that the external-auth facility be active on the target server.

Generated by OpenCVE AI on July 26, 2026 at 20:30 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenVPN to version 2.6.21 or later, or to 2.7.5 or newer to eliminate the assertion bug.
  • If upgrading immediately is not feasible, disable the external-auth directive in the server configuration to suppress the vulnerable code path.
  • After applying the upgrade or the configuration change, restart the OpenVPN service to ensure the fix is active and monitor for unexpected restarts or downtime.

Generated by OpenCVE AI on July 26, 2026 at 20:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4666-1 openvpn security update
Debian DSA Debian DSA DSA-6376-1 openvpn security update
Ubuntu USN Ubuntu USN USN-8540-1 OpenVPN vulnerabilities
History

Thu, 09 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
Title openvpn: From CVEorg collector
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Tue, 07 Jul 2026 17:45:00 +0000

Type Values Removed Values Added
Title Remote Denial of Service via Malformed Authentication Token When External Authentication Enabled

Tue, 07 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Title Remote Denial of Service via Malformed Authentication Token When External Authentication Enabled

Mon, 06 Jul 2026 16:45:00 +0000

Type Values Removed Values Added
First Time appeared Openvpn
Openvpn openvpn
Vendors & Products Openvpn
Openvpn openvpn

Mon, 06 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled
Weaknesses CWE-617
References
Metrics cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Openvpn Openvpn
cve-icon MITRE

Status: PUBLISHED

Assigner: OpenVPN

Published:

Updated: 2026-07-06T15:51:50.731Z

Reserved: 2026-06-23T22:11:24.264Z

Link: CVE-2026-13122

cve-icon Vulnrichment

Updated: 2026-07-06T15:51:47.740Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-06T14:32:29Z

Links: CVE-2026-13122 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T20:45:03Z

Weaknesses