This flaw stems from the server step not verifying the nonce supplied by the client during a DIGEST-MD5 authentication exchange. The server issues a fresh nonce in the challenge and never later cross‑checks that the nonce returned in the client’s response matches the one that was originally sent. Consequently, the server accepts any response whose digest matches the nonce carried in the message, and the nonce counter is reset for each new server instance. An attacker who records a successful authentication can replay that exact response against a new session for the same service, user, and realm, thereby authenticating as that user without needing the password.

The impacted component is the Perl Authen::SASL library’s DIGEST-MD5 implementation, versions prior to 2.2100. The vulnerability is present in all releases of Authen::SASL that implement this class before the 2.2100 update, which was released to address this issue.

An adversary can capture a single authenticated session and reuse the response on future connections, achieving unauthorized access to the target service. The security impact is a full authentication bypass. No EPSS information is available, and the vulnerability is not listed in CISA’s KEV catalog, but the absence of nonce verification makes it trivial to exploit once credentials are captured. Guided by the provided CWE–294 identification of improper cryptographic input handling, the risk is readily actionable.