{"id":"EUVD-2026-28789","enisaUuid":"834b5f81-9f57-3a14-ba86-28df1ce05809","description":"openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients that do not support WebAuth/SSO (e.g., the openvpn CLI on Linux) are incorrectly admitted to the VPN despite being denied by the authentication logic. The default management-interface mode is not affected because it does not use the OpenVPN plugin return-code mechanism. This issue has been patched in version 1.27.3.","datePublished":"May 8, 2026, 3:14:46 PM","dateUpdated":"May 8, 2026, 4:05:34 PM","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","references":"https://github.com/jkroepke/openvpn-auth-oauth2/security/advisories/GHSA-246w-jgmq-88fg\nhttps://github.com/jkroepke/openvpn-auth-oauth2/commit/36f69a6c67c1054da7cbfa04ced3f0555127c8f2\n","aliases":"CVE-2026-41070\nGHSA-246w-jgmq-88fg\n","assigner":"GitHub_M","epss":0.44,"enisaIdProduct":[{"id":"164b7eeb-c824-3cb5-b94a-84c93480e564","product":{"name":"openvpn-auth-oauth2","vendor":{"name":"jkroepke"}},"product_version":"1.26.3, \u003c 1.27.3"}],"enisaIdVendor":[{"id":"2563f7fe-389b-3d47-974d-05b84bf9a084","vendor":{"name":"jkroepke"}}],"enisaIdVulnerability":[{"id":"4c5251cc-0d95-3651-aa6b-7d512eea85ab","vulnerability":{"id":"CVE-2026-41070","description":"openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients that do not support WebAuth/SSO (e.g., the openvpn CLI on Linux) are incorrectly admitted to the VPN despite being denied by the authentication logic. The default management-interface mode is not affected because it does not use the OpenVPN plugin return-code mechanism. This issue has been patched in version 1.27.3.","datePublished":"May 8, 2026, 3:14:46 PM","dateUpdated":"May 8, 2026, 4:05:34 PM","status":"PUBLISHED","baseScore":10.0,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","references":"https://github.com/jkroepke/openvpn-auth-oauth2/security/advisories/GHSA-246w-jgmq-88fg\nhttps://github.com/jkroepke/openvpn-auth-oauth2/commit/36f69a6c67c1054da7cbfa04ced3f0555127c8f2\n","enisa_id":"EUVD-2026-28789\n","assigner":"GitHub_M","epss":0.44,"dataProcessed":"Oct 30, 2026, 7:16:28 AM","vulnerabilityProduct":[{"id":"1075170e-4d3e-3454-810c-489ce2b1693c","product":{"name":"openvpn-auth-oauth2","vendor":{"name":"jkroepke"}},"product_version":"1.26.3, \u003c 1.27.3"}],"vulnerabilityVendor":[{"id":"c2e3edec-3c22-376b-8035-47214de05a33","vendor":{"name":"jkroepke"}}]}},{"id":"6d61bbef-553c-314c-a3e2-3da8c8aabaf3","vulnerability":{"id":"GHSA-246w-jgmq-88fg","description":"openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access","datePublished":"Apr 22, 2026, 2:28:11 PM","dateUpdated":"May 13, 2026, 1:29:35 PM","baseScore":0.0,"references":"https://github.com/jkroepke/openvpn-auth-oauth2/security/advisories/GHSA-246w-jgmq-88fg\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41070\nhttps://github.com/jkroepke/openvpn-auth-oauth2/pull/829\nhttps://github.com/jkroepke/openvpn-auth-oauth2/commit/36f69a6c67c1054da7cbfa04ced3f0555127c8f2\nhttps://github.com/OpenVPN/openvpn/blob/master/include/openvpn-plugin.h.in\nhttps://github.com/OpenVPN/openvpn3/blob/master/doc/webauth.md\nhttps://github.com/jkroepke/openvpn-auth-oauth2\nhttps://github.com/jkroepke/openvpn-auth-oauth2/releases/tag/v1.27.3\n","enisa_id":"EUVD-2026-28789\n","aliases":"GHSA-246w-jgmq-88fg\nCVE-2026-41070\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}