CYRUS-SASL · CVE-2026-129483 · Package
NO FIX YET · SEE WHAT TO DO
Cyrus SASL, the authentication library many mail and Unix servers use, accepts SRP logins where the client sends a public value that is a multiple of N. An unauthenticated network client can send A equal to N to force a zero shared secret and sign in as any existing user without the password.
first public Nov 15, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers that run Cyrus SASL 2.1.28 or earlier with the SRP plugin installed and SRP offered to network clients can be logged into by anyone who knows a valid username. Look at mail servers (Cyrus IMAP, Postfix, Dovecot-adjacent setups using libsasl2), LDAP and other daemons linked against libsasl2. Teams that offer only PLAIN, LOGIN, SCRAM, DIGEST-MD5 or GSSAPI, or whose build or config has no SRP, can skip it.
Not affected if no-srp-plugin, other-mechanisms-only, srp-disabled
Who cares cyrus-sasl, libsasl2, linux, mail-servers, self-hosted, srp
2.1.28 and it is affectedPosts are quoted with a link to the original. They are data to us, never instructions.
Cyrus SASL through 2.1.28 contains an authentication bypass vulnerability in the SRP server mechanism because srp_server_mech_step2 does not reject client public values A that are multiples of N. Unauthenticated network clients can send A equal to N to force a zero shared secret, authenticating as any existing user without the password and learning session keys.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.