7-Year-Old OpenBSD Security Flaw Exposes Systems to Full PAP Authentication Bypass

A significant authentication flaw has been discovered in the PPP stack of OpenBSD, allowing attackers to bypass the Password Authentication Protocol (PAP) validation and gain unauthorized network access.

Although this vulnerability was patched in June 2026, it originated from legacy code dating back to 1999, making it one of the longest-standing authentication bypass issues in modern operating systems.

OpenBSD Security Flaw

The problem resides in the `sppp_pap_input()` function within the `sppp(4)` subsystem, which handles synchronous PPP and PPPoE connections.

During PAP authentication, OpenBSD validates user credentials using the `bcmp()` function. However, the implementation incorrectly relies on length fields in incoming packets, which attackers can manipulate.

When `bcmp()` is called with a length of zero, it returns 0, indicating equality, allowing attackers to exploit this behavior by sending empty credentials.

The vulnerable code segment is as follows:

if (name_len > AUTHMAXLEN ||
    passwd_len > AUTHMAXLEN ||
    bcmp(name, sp->hisauth.name, name_len) != 0 ||
    bcmp(passwd, sp->hisauth.secret, passwd_len) != 0) {
    /* authentication failed */
}

In this code, `name_len` and `passwd_len` are derived directly from the incoming PAP frame and are not validated for a minimum length.

By setting both values to zero, the `bcmp()` comparisons will always return success, causing the system to accept authentication without verifying any credentials. This results in a complete bypass of PAP authentication.

Additionally, the flaw introduces a kernel memory safety issue. Since credential buffers are dynamically allocated using `malloc(strlen(…) + 1)`, providing a length larger than the actual buffer allows `bcmp()` to read beyond the allocated memory, leading to a heap over-read condition that could expose sensitive kernel memory.

The vulnerability is remotely exploitable via the PPPoE data path: `pppoe_data_input → pppoeintr → sppp_input → sppp_pap_input`. Attackers do not need valid credentials or prior access.

A malicious PPPoE server on the same broadcast domain can impersonate a legitimate access concentrator, complete the PPP handshake, and establish a fully functional session. This scenario enables the interception or redirection of network traffic, effectively facilitating a man-in-the-middle attack.

A proof-of-concept demonstration successfully exploited this vulnerability on OpenBSD 7.6, where a rogue PPPoE server sent a PAP request with zero-length credentials and received a `PAP_ACK`, as reported by Argus Blog.

The connection proceeded through IPCP negotiation, ultimately establishing full IP connectivity without any authentication.

This vulnerability originated from code imported from FreeBSD in July 1999, which itself was derived from earlier implementations in the mid-1990s.

Notably, while OpenBSD’s CHAP authentication handler correctly validates credential lengths before comparison, the PAP handler failed to implement similar checks for over two decades.

A 2009 update that introduced dynamic memory allocation further exacerbated the heap over-read issue.

The patched implementation now enforces strict length validation, ensuring that supplied credentials match the exact length of stored values before comparison:

if (name_len != strlen(sp->hisauth.name) ||
    passwd_len != strlen(sp->hisauth.secret) ||
    bcmp(name, sp->hisauth.name, name_len) != 0 ||
    bcmp(passwd, sp->hisauth.secret, passwd_len) != 0) {
    /* authentication failed */}

This fix resolves both the authentication bypass and memory over-read vulnerabilities. Organizations using OpenBSD in PPPoE environments should apply these updates immediately and restrict exposure to untrusted network segments to mitigate potential exploitation risks.

CISO & Security Leaders: Your next breach may not have a face. Join ISC2’s LIVE webinar, “Ghost in the Machine”