{"id":"GO-2026-4963","revision":"6f5915cfd7334bbbb4736f236a057ce1","records":[{"revision":"6f5915cfd7334bbbb4736f236a057ce1","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-4963","aliases":["CVE-2026-41070","GHSA-246w-jgmq-88fg"],"title":"openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access in github.com/jkroepke/openvpn-auth-oauth2","description":"openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access in github.com/jkroepke/openvpn-auth-oauth2","state":0,"publishedAt":"2026-05-20T19:07:16+00:00","modifiedAt":"2026-05-20T19:30:11.5436337+00:00","affected":[{"ecosystem":"Go","name":"github.com/jkroepke/openvpn-auth-oauth2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.26.3"},{"kind":"fixed","version":"1.27.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/jkroepke/openvpn-auth-oauth2/security/advisories/GHSA-246w-jgmq-88fg","https://nvd.nist.gov/vuln/detail/CVE-2026-41070","https://github.com/jkroepke/openvpn-auth-oauth2/commit/36f69a6c67c1054da7cbfa04ced3f0555127c8f2","https://github.com/jkroepke/openvpn-auth-oauth2/pull/829","https://github.com/OpenVPN/openvpn/blob/master/include/openvpn-plugin.h.in","https://github.com/OpenVPN/openvpn3/blob/master/doc/webauth.md","https://github.com/jkroepke/openvpn-auth-oauth2/releases/tag/v1.27.3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-4963","license":"OSV · upstream source license applies","key":"osv:GO-2026-4963","identifiers":["GO-2026-4963","CVE-2026-41070","GHSA-246w-jgmq-88fg"]},"retained":false,"historicalAffected":[]}],"coverage":[]}