27‑Year‑Old PAP Authentication Bypass in OpenBSD

Attack Techniques & Methods2026-06-25, 07:04
An Argus Systems post reveals that a comparison bug had existed in OpenBSD's sppp(4) subsystem since 1999. The flaw in bcmp allowed PAP authentication to succeed when both the username and password lengths were zero. With name_len=0 and passwd_len=0, calls to bcmp() returned 0, allowing authentication to succeed without any credentials.
The bug also allowed kernel memory reads: if name_len exceeded the actual size of sp->hisauth.name, bcmp could read beyond the object's memory boundaries.
🥷🏻 An attacker on the same L2 network segment (broadcast domain) could spin up a rogue PPPoE server, complete the entire handshake, and redirect the victim's traffic through a controlled node.
⚠️ The issue is tracked as CVE‑2026‑55706 and affects all OpenBSD versions from July 1, 1999, through June 14, 2026. Exploitation requires no privileges.
The patch adds strict string‑length checks, matching the existing CHAP handling, and fixes both issues:
c
if (name_len != strlen(sp->hisauth.name) ||
    passwd_len != strlen(sp->hisauth.secret) ||
    bcmp(name, sp->hisauth.name, name_len) != 0 ||
    bcmp(passwd, sp->hisauth.secret, passwd_len) != 0) {```

📎 Article: https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html
🦠 PoC is attached to the post as a file: https://blog.argus-systems.ai/blog/poc-001-pap-bypass.py
Vulnerabilities
8.3
CVE-2026-55706
Researchers
Argus
Vendors
Argus Systems
Openbsd
Products
Openbsd
Sppp(4)