OpenBSD ppp PPPoE PAP Authentication Bypass via Zero-Length Credentials

Vulnerability Overview A 27-year-old authentication bypass vulnerability exists in OpenBSD's stack. The vulnerability is located in the function, where an attacker can bypass PAP authentication by sending zero-length username and password fields, causing to unconditionally return 0. This vulnerability has remained unfixed since its introduction in 1999. Scope of Impact Vulnerability Location: The function in . Attack Path: Accessible via the PPPoE data path; the attacker can complete authentication without any credentials. Specific Impact: An attacker can impersonate a legitimate server and hijack the victim's IP traffic. Remediation The fix applies the same exact-length pre-check used by the CHAP handler: This fix prevents the zero-length bypass and restricts the length passed to to the exact size of the stored credentials, thereby eliminating the heap overflow risk. The fix was committed on June 14, 2026. Proof of Concept (POC) The POC script acts as a PPPoE server. After completing PPPoE discovery and LCP negotiation, it sends a PAP Auth-Request containing zero-length username and password fields. OpenBSD responds with a , and the link reaches a full network-layer operational state. Timeline 1999-07-01: The code, vulnerable to the comparison flaw, was imported from FreeBSD to OpenBSD. 2009-02-16: Authentication fields were changed to dynamic allocation using , enabling heap overflow. 2026-06-12: The vulnerability was reported to OpenBSD, along with the proof of concept. 2026-06-14: Fix committed. Tags #openbsd #kernel #ppp #authentication #misconfigure

Goal Reached Thanks to every supporter — we hit 100%!

OpenBSD ppp PPPoE PAP Authentication Bypass via Zero-Length Credentials