10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41070

CVE-2026-41070: openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access

openvpn-auth-oauth2 is a plugin/management interface client for OpenVPN server to handle an OIDC based single sign-on (SSO) auth flows. From version 1.26.3 to before version 1.27.3, when openvpn-auth-oauth2 is deployed in the experimental plugin mode (shared library loaded by OpenVPN via the plugin directive), clients that do not support WebAuth/SSO (e.g., the openvpn CLI on Linux) are incorrectly admitted to the VPN despite being denied by the authentication logic. The default management-interface mode is not affected because it does not use the OpenVPN plugin return-code mechanism. This issue has been patched in version 1.27.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41070

CVE-2026-41070:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/jkroepke/openvpn-auth-oauth2	go	>= 1.26.3, < 1.27.3	1.27.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the incorrect handling of authentication denial within the openvpn-auth-oauth2 plugin's experimental mode. The root cause was identified in the handleAuthUserPassVerify function located in lib/openvpn-auth-oauth2/openvpn/handle.go. When a client that does not support web authentication attempts to connect, the plugin's logic correctly determines that the client should be denied. However, instead of returning an error code to the OpenVPN server, it returned OPENVPN_PLUGIN_FUNC_SUCCESS. The OpenVPN server treats this success code as an approval for connection, thus bypassing the authentication mechanism entirely. The patch in commit 36f69a6c67c1054da7cbfa04ced3f0555127c8f2 rectifies this by changing the return value to OPENVPN_PLUGIN_FUNC_ERROR in the case of a client denial, ensuring that the OpenVPN server correctly terminates the connection attempt. This makes handleAuthUserPassVerify the direct location of the vulnerability.

Vulnerable functions

openvpn.PluginHandle.handleAuthUserPassVerify

lib/openvpn-auth-oauth2/openvpn/handle.go

The function `handleAuthUserPassVerify` incorrectly returned `OPENVPN_PLUGIN_FUNC_SUCCESS` when client authentication was denied for clients not supporting web authentication. The OpenVPN server interprets this status as a successful authentication, granting the client network access despite the intended denial. The fix changes the return value to `OPENVPN_PLUGIN_FUNC_ERROR`, ensuring the OpenVPN server correctly rejects the unauthenticated client.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.