Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-86219— Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step

Quick assessment

Affected
CVE-2026-86219
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是对该漏洞描述的中文翻译： Authen::SASL::Perl::DIGEST_MD5 版本 2.2100 之前的 Perl 模块，其 函数未对 nonce（随机数）进行验证，从而允许攻击者重放认证响应。 技术细节说明： 1. 函数会生成一个新的 nonce 并将其包含在挑战（challenge）中发送给客户端。 2. 然而，后续流程中并没有将该 nonce 与客户端返回的 nonce 进行比较验证。 3. 函数根据客户端自身提供的参数来计算预期的摘要（digest），因此，只要响应中的摘要与其携带的 non

AI Predicted 6.5 Difficulty: Moderate

Possible ATT&CK Techniques 2 AI

T1557 · Adversary-in-the-Middle T1083.003

Affected Version Matrix 1

VendorProduct Version RangeStatus
None None < 2.2100 affected

I. Basic Information for CVE-2026-86219

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step
Source: CVE Program / CVE List V5
Vulnerability Description
Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 for Perl accept replayed authentication responses via unverified nonce in server_step. server_start generates a fresh nonce and sends it in the challenge, and nothing later compares that value against the nonce the client returns. server_step derives the expected digest from the client's own parameters, so a response verifies whenever its digest matches the nonce it carries. The count table it also checks is keyed on the client-supplied nonce and starts empty in each new server object, so a captured first response, carrying `nc=00000001`, passes that too. RFC 2831 defines the nonce in the response as the value the server sent in the preceding challenge. An attacker who observes one successful `qop=auth` exchange can replay the captured response against a later session for the same service, host, realm and user, and authenticate as that user without knowing the password.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
使用捕获-重放进行的认证绕过
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
- - 0 ~ 2.2100 -

II. Public POCs for CVE-2026-86219

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-86219

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-86219 (2)

Vendor Pages for CVE-2026-86219 (2)

Other References for CVE-2026-86219 (1)

IV. Related Vulnerabilities

Same weakness: CWE-294

V. Comments for CVE-2026-86219

No comments yet

Leave a comment