Authentication Bypass in vsftpd Affects FTP Data Connections
CVE-2026-119568

9.1CRITICAL

Key Information:

Vendor

Vsftpd

Status
Vsftpd
Vendor
CVE Published:
30 October 2026

What is CVE-2026-119568?

vsftpd, a popular FTP server, is susceptible to an authentication bypass vulnerability in the ssl_data_accept() function. This flaw enables potential attackers to hijack FTPS data connections by leveraging TLS session tickets. By sharing the victim's source IP, attackers can initiate an AUTH TLS command to obtain a session ticket, allowing them to connect to the victim's PASV port. This connection could facilitate unauthorized access to sensitive downloads or enable data injection during uploads, compromising the integrity and confidentiality of file transfers.

Affected Version(s)

vsftpd 0 <= 3.0.5

References

https://abraxaslabs.tech/research/vsftpd-ssl-data-any-ticket
third-party-advisory
https://security.appspot.com/vsftpd.html
product
https://www.vulncheck.com/advisories/vsftpd-through-3.0.5...
third-party-advisory

CVSS V4

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abraxas Labs
.