Authentication Bypass in C-Kermit IKSD SSL Product by OpenKermit
CVE-2026-129116

7.7HIGH

Key Information:

Vendor

Openkermit

Status
C-kermit
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129116?

C-Kermit versions before 11.1.515 are vulnerable to an authentication bypass issue. When a denied certificate login occurs, the system does not reset the Telnet authentication state, allowing attackers with access to a trusted certificate linked to a refused account to log in as any other user by providing any password. This flaw significantly compromises account security, enabling unauthorized shell access.

Affected Version(s)

C-Kermit 7.0.197 < 11.1.515

References

https://github.com/OpenKermit/ckermit/security/advisories...
vendor-advisory
https://github.com/OpenKermit/ckermit/commit/fdfe8f13159f...
patch
https://github.com/OpenKermit/ckermit/releases/tag/v11.1.515
release-notes

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

John Goerzen
John Goerzen
.