CVE-2026-86219: Authen::SASL::Perl DIGEST_MD5 Auth Bypass

CVE-2026-86219 Overview

CVE-2026-86219 is an improper authentication vulnerability [CWE-294] in the Perl module Authen::SASL::Perl::DIGEST_MD5 before version 2.2100. The server-side implementation of DIGEST-MD5 fails to verify that the nonce returned by the client matches the nonce issued in the preceding challenge. An attacker who captures one successful qop=auth exchange can replay the response against a later session for the same service, host, realm, and user. Replay succeeds without knowledge of the user's password.

Critical Impact

Attackers who observe a single successful DIGEST-MD5 authentication can replay it to impersonate the victim on subsequent sessions, bypassing password authentication entirely.

Affected Products

• Authen::SASL Perl distribution versions before 2.2100
• Authen::SASL::Perl::DIGEST_MD5 server-side implementation
• Perl applications and services that rely on this module for SASL DIGEST-MD5 authentication

Discovery Timeline

• 2026-09-06 - Patched release Authen-SASL 2.2100 published with fix credited to TIMLEGGE and the CPANSec team
• 2026-09-06 - CVE-2026-86219 published to NVD
• 2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86219

Vulnerability Analysis

The flaw resides in the server_step routine of Authen::SASL::Perl::DIGEST_MD5. RFC 2831 section 2.1.2 requires the nonce in the digest-response to equal the value the server sent in the preceding digest-challenge. The vulnerable implementation never performs that comparison. Instead, it derives the expected digest from the client's own parameters, so any response whose digest is internally consistent with the nonce it carries will validate.

A secondary check on nc (nonce-count) uses a per-object hash keyed on the client-supplied nonce. Because the counter table is empty when a new server object is instantiated, a replayed first response carrying nc=00000001 also passes. The result is a complete break of the replay resistance that RFC 2831 section 3.3 assumes.

Root Cause

The server generates a fresh nonce in server_start and transmits it in the challenge, but no subsequent code path binds the response to that issued value. The trust boundary between server-issued state and client-supplied state was never enforced.

Attack Vector

An adversary positioned to observe network traffic captures one legitimate qop=auth exchange between a client and server. The attacker then initiates a new session to the same service, host, realm, and user, and replays the captured digest-response. Because the server accepts any nonce the client supplies and its counter table starts empty, authentication succeeds.

 # RFC 2831 section 2.1.2: the nonce in the digest-response is "the
 # server-specified data string received in the preceding digest-challenge".
 # The replay resistance of section 3.3 rests on the server binding the
 # response to the nonce it issued, so check that before anything else uses
 # the client-supplied value.
 unless (defined $self->{nonce} and $cparams{nonce} eq $self->{nonce}) {
   $self->set_error("nonce does not match the one issued");
   return $cb->();
 }

 my $count = hex ($cparams{'nc'} || 0);
 unless ($count == ++$self->{nonce_counts}{$cparams{nonce}}) {
   $self->set_error("nonce-count doesn't match: $count");

Source: GitHub Commit Patch

Detection Methods for CVE-2026-86219

Indicators of Compromise

• Repeated authentication successes from distinct source addresses using identical DIGEST-MD5 nonce and cnonce values for the same account.
• Multiple sessions for one user reusing nc=00000001 within short time windows against services backed by Authen::SASL.
• Unexpected authentication events for user accounts from network locations that do not match historical baselines.

Detection Strategies

• Inventory Perl services (IMAP, SMTP, LDAP, XMPP, custom daemons) that link against Authen::SASL and identify installations pinned below 2.2100.
• Enable protocol-level logging on SASL-enabled services to record challenge and response nonces, then alert on duplicate (nonce, cnonce, digest-uri) tuples across sessions.
• Correlate authentication logs with network telemetry to identify successful logins that do not correspond to newly generated server challenges.

Monitoring Recommendations

• Forward SASL authentication logs to a centralized analytics pipeline and retain nonce metadata to enable retrospective replay analysis.
• Monitor for anomalous patterns of successful qop=auth exchanges where the same client-supplied nonce reappears across independent TCP sessions.
• Track upgrades of the Authen::SASL CPAN dependency across all Perl runtimes in the environment to confirm remediation coverage.

How to Mitigate CVE-2026-86219

Immediate Actions Required

• Upgrade the Authen::SASL distribution to version 2.2100 or later on every host running Perl-based SASL server code.
• Audit application dependency manifests (cpanfile, Makefile.PL, Build.PL) and container images for pinned versions below 2.2100.
• Rotate credentials for any accounts whose DIGEST-MD5 authentications may have been observed on untrusted networks.

Patch Information

The fix is included in Authen-SASL 2.2100, released 2026-09-06. The patch adds an explicit comparison between $cparams{nonce} and $self->{nonce} in server_step before any counter logic runs, restoring the binding required by RFC 2831 section 2.1.2. See the GitHub Commit Patch and the MetaCPAN Authen-SASL Changes.

Workarounds

• Disable DIGEST-MD5 as an offered SASL mechanism and require stronger alternatives such as SCRAM-SHA-256 or GSSAPI where the server supports them.
• Terminate SASL-authenticated protocols inside TLS to prevent passive capture of the digest-response by network adversaries.
• Restrict network exposure of affected services to trusted segments until the upgrade to 2.2100 is deployed.

# Upgrade Authen::SASL from CPAN to the fixed release
cpanm Authen::SASL@2.2100

# Verify the installed version
perl -MAuthen::SASL -e 'print $Authen::SASL::VERSION, "\n"'