PT-2026-34452 · Unknown · Openvpn-Auth-Oauth2

Kkalev · Published 2026-04-22 · Updated 2026-05-20 · CVE-2026-41070

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions openvpn-auth-oauth2 versions 1.26.3 through 1.27.2

Description An authentication bypass exists when the software is deployed in experimental plugin mode. Clients that do not support WebAuth/SSO are incorrectly granted full network access without completing OIDC authentication. This occurs because the handleAuthUserPassVerify function in lib/openvpn-auth-oauth2/openvpn/handle.go returns OPENVPN PLUGIN FUNC SUCCESS even when a client is denied. OpenVPN interprets this return code as successful authentication, ignoring the deny command written to the auth control file unless the plugin returns FUNC DEFERRED.

Recommendations Update openvpn-auth-oauth2 to version 1.27.3. Switch to standalone management client mode. Restrict VPN access at the network level to only clients known to support WebAuth/SSO.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-41070

GHSA-246W-JGMQ-88FG

GO-2026-4963

Affected Products

Openvpn-Auth-Oauth2

References · 27

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-41070 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-41070 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41070 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-41070 · Security Note
• https://ubuntu.com/security/CVE-2026-41070 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-41070 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-246w-jgmq-88fg · Vendor Advisory
• https://github.com/OpenVPN/openvpn/blob/master/include/openvpn-plugin.h.in · Note
• https://github.com/OpenVPN/openvpn3/blob/master/doc/webauth.md · Note
• https://github.com/jkroepke/openvpn-auth-oauth2/releases/tag/v1.27.3 · Note
• https://github.com/jkroepke/openvpn-auth-oauth2/pull/829 · Note
• https://github.com/jkroepke/openvpn-auth-oauth2/commit/36f69a6c67c1054da7cbfa04ced3f0555127c8f2 · Note
• https://github.com/jkroepke/openvpn-auth-oauth2/security/advisories/GHSA-246w-jgmq-88fg · Note
• https://github.com/jkroepke/openvpn-auth-oauth2 · Note