openvpn-auth-oauth2 is a plugin that mediates OAuth2 authentication for OpenVPN servers. Between versions 1.26.3 and just before 1.27.3, when the plugin is used in experimental mode, clients that do not support WebAuth/SSO are mistakenly granted access after the authentication logic otherwise denies them. The plugin returns a success code even though the authentication should fail, providing unauthenticated VPN entry. This flaw is represented by CWE‑287 and enables an attacker to obtain VPN connectivity without valid credentials.

The flaw affects the jkroepke openvpn‑auth‑oauth2 product, specifically any deployment of versions 1.26.3 through 1.27.2 that employs the experimental plugin mode. The default management‑interface mode is not impacted, as it does not invoke the plugin’s return‑code mechanism. Other OpenVPN versions or configurations that do not use the experimental plugin mode remain unaffected.

The CVSS score of 10 indicates a critical risk. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. It can be exploited from any network where an OpenVPN server loads the experimental plugin; an unauthenticated client can initiate a VPN session and receive network access, potentially enabling lateral movement. The attack requires no prior compromise or privileged access and can be performed over an open connection, making it highly dangerous for exposed VPN services.