Authentication Bypass Vulnerability in Cyrus SASL Software
CVE-2026-129483

9.3CRITICAL

Key Information:

Vendor

Cyrusimap

Status
Cyrus-sasl
Vendor
CVE Published:
15 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-129483?

Cyrus SASL versions up to 2.1.28 contain a serious authentication bypass flaw within the SRP server mechanism. The vulnerability arises when the function srp_server_mech_step2 fails to reject client public values A that are multiples of N. This allows unauthenticated network clients to manipulate the authentication process by sending A equal to N. Consequently, attackers can establish a zero shared secret, enabling them to authenticate as any pre-existing user without needing a password and potentially gaining access to sensitive session keys.

Affected Version(s)

cyrus-sasl 0 <= 2.1.28

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-129483 - Proof of Concept

References

https://github.com/cyrusimap/cyrus-sasl/issues/896
issue-tracking
https://seclists.org/oss-sec/2026/q4/122
mailing-list
https://gist.github.com/afldl/18d15d3f5a1df99411e35000c7d...
exploit

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

afldl
.