{"id":"CVE-2026-129483","kind":"vulnerability","aliases":["CVE-2026-129483"],"related":[],"title":"Cyrus SASL: SRP login accepts a forged key, letting anyone log in","description":"Cyrus SASL through 2.1.28 contains an authentication bypass vulnerability in the SRP server mechanism because srp_server_mech_step2 does not reject client public values A that are multiples of N. Unauthenticated network clients can send A equal to N to force a zero shared secret, authenticating as any existing user without the password and learning session keys.","summary":"Cyrus SASL, the authentication library many mail and Unix servers use, accepts SRP logins where the client sends a public value that is a multiple of N. An unauthenticated network client can send A equal to N to force a zero shared secret and sign in as any existing user without the password.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cyrus-sasl","fixed":[],"affected":"<= 2.1.28","ecosystem":"vendor"}],"ecosystems":[],"tags":["cyrus-sasl","libsasl2","linux","mail-servers","package","self-hosted","srp"],"not_affected_if":["no-srp-plugin","other-mechanisms-only","srp-disabled"],"how_to_check":"- Find the installed version: pkg-config --modversion libsasl2, or your package manager (dpkg -l libsasl2-2, rpm -q cyrus-sasl-lib). 2.1.28 and earlier is the affected range.\n- Check whether the SRP plugin is installed: ls /usr/lib*/sasl2/ /usr/lib/*/sasl2/ for libsrp.so. If absent, SRP cannot be negotiated.\n- Check your service config (Cyrus IMAP imapd.conf sasl_mech_list, Postfix smtpd_sasl_security_options, app .conf files named by sasl2 mech_list) and see whether SRP is offered. Also confirm with an AUTH or CAPABILITY greeting that lists SRP.\n- Also check any daemon statically linked against libsasl2 that carries its own copy.","fix":"No released fix: the latest release is 2.1.28 and it is affected. The maintainers' master branch removed the SRP plugin entirely in commit fb3724f (2026-11-12); no release carries it yet. Until one does, stop offering SRP: leave SRP out of mech_list (and sasl_mech_list), or build with SRP disabled, or remove the installed libsasl2 SRP plugin (libsrp.so) from the plugin directory. Distribution packages may backport.","status":"open","published_at":"2026-11-15T14:17:27+00:00","first_seen_at":"2026-11-15T14:36:16+00:00","triaged_at":"2026-11-15T14:37:15+00:00","updated_at":"2026-11-15T14:38:15+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-15T14:37:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Cyrus SASL: SRP login accepts a forged key, letting anyone log in","impact":"high","summary":"Cyrus SASL, the authentication library many mail and Unix servers use, accepts SRP logins where the client sends a public value that is a multiple of N. An unauthenticated network client can send A equal to N to force a zero shared secret and sign in as any existing user without the password.","audience":"businesses","category":"package","nicknames":[],"who_cares":["cyrus-sasl","libsasl2","srp","mail-servers","linux"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in as any existing user without password","analyst_note":"Confirm the fixed version and whether SRP is enabled by default, using the linked GitHub patch and the vulncheck advisory.","how_to_check":"- Check whether the installed Cyrus SASL version is `2.1.28` or earlier.\n- Look for the SRP mechanism in server config, for example `mech_list` containing `SRP`.\n- Find services linked against libsasl2 (such as `ldd` on the mail or auth daemon) and confirm the library version.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["srp-disabled","other-mechanisms-only"],"who_is_affected":"Servers that run Cyrus SASL through 2.1.28 with the SRP mechanism enabled on the network-facing authentication path are exposed. Systems that do not offer SRP, or that use other SASL mechanisms only, are not affected by this description. Sources do not name a fixed version; a patch is linked from the vendor's GitHub.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000769,"input_tokens":4606,"output_tokens":616,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether SRP is enabled by default, using the linked GitHub patch and the vulncheck advisory.","search":"'-129483':14A,17A '-2026':13A,16A '2.1.28':90C 'accept':5A,45B 'anyon':10A 'authent':37B,93C,133C 'bypass':94C 'client':50B,64B,109C,120C 'contain':91C 'cve':12A,15A 'cyrus':1A,19A,22B,34B,87C 'cyrus-sasl':18A,21B 'equal':68B,124C 'exist':82B,136C 'forc':72B,128C 'forg':7A 'host':32B 'key':8A,144C 'learn':142C 'let':9A 'librari':38B 'libsasl2':24B 'linux':25B 'log':11A 'login':4A,47B 'mail':27B,40B 'mail-serv':26B 'mani':39B 'mech':104C 'mechan':100C 'multipl':58B,115C 'n':60B,70B,117C,126C 'network':63B,119C 'packag':29B 'password':86B,140C 'public':53B,110C 'reject':108C 'sasl':2A,20A,23B,35B,88C 'secret':76B,132C 'self':31B 'self-host':30B 'send':51B,66B,122C 'server':28B,43B,99C,103C 'session':143C 'share':75B,131C 'sign':78B 'srp':3A,33B,46B,98C,102C 'step2':105C 'unauthent':62B,118C 'unix':42B 'use':44B 'user':83B,137C 'valu':54B,111C 'vulner':95C 'without':84B,138C 'zero':74B,130C","nicknames":[],"mitigations":[],"who_affected":"Servers that run Cyrus SASL 2.1.28 or earlier with the SRP plugin installed and SRP offered to network clients can be logged into by anyone who knows a valid username. Look at mail servers (Cyrus IMAP, Postfix, Dovecot-adjacent setups using libsasl2), LDAP and other daemons linked against libsasl2. Teams that offer only PLAIN, LOGIN, SCRAM, DIGEST-MD5 or GSSAPI, or whose build or config has no SRP, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["cyrussasl"],"ptokens":["cyrus","sasl"],"labels":["critical","cyrussasl","libsasl2","linux","mailservers","package","selfhosted","srp"],"campaign_type":null,"search_a":"'-129483':14A,17A '-2026':13A,16A 'accept':5A 'anyon':10A 'cve':12A,15A 'cyrus':1A,19A 'cyrus-sasl':18A 'forg':7A 'key':8A 'let':9A 'log':11A 'login':4A 'sasl':2A,20A 'srp':3A","search_b":"'accept':45B 'authent':37B 'client':50B,64B 'cyrus':22B,34B 'cyrus-sasl':21B 'equal':68B 'exist':82B 'forc':72B 'host':32B 'librari':38B 'libsasl2':24B 'linux':25B 'login':47B 'mail':27B,40B 'mail-serv':26B 'mani':39B 'multipl':58B 'n':60B,70B 'network':63B 'packag':29B 'password':86B 'public':53B 'sasl':23B,35B 'secret':76B 'self':31B 'self-host':30B 'send':51B,66B 'server':28B,43B 'share':75B 'sign':78B 'srp':33B,46B 'unauthent':62B 'unix':42B 'use':44B 'user':83B 'valu':54B 'without':84B 'zero':74B","search_c":"'2.1.28':90C 'authent':93C,133C 'bypass':94C 'client':109C,120C 'contain':91C 'cyrus':87C 'equal':124C 'exist':136C 'forc':128C 'key':144C 'learn':142C 'mech':104C 'mechan':100C 'multipl':115C 'n':117C,126C 'network':119C 'password':140C 'public':110C 'reject':108C 'sasl':88C 'secret':132C 'send':122C 'server':99C,103C 'session':143C 'share':131C 'srp':98C,102C 'step2':105C 'unauthent':118C 'user':137C 'valu':111C 'vulner':95C 'without':138C 'zero':130C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129483","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129483","severity":null,"published_at":"2026-11-15T14:17:27+00:00","modified_at":"2026-11-15T14:17:27+00:00","first_seen_at":"2026-11-15T14:36:16+00:00","fetched_at":"2026-11-15T14:36:16+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129483:4040","url":"https://github.com/cyrusimap/cyrus-sasl/issues/896","severity":null,"published_at":"2026-11-15T14:38:15+00:00","modified_at":"2026-11-15T14:38:15+00:00","first_seen_at":"2026-11-15T14:38:15+00:00","fetched_at":"2026-11-15T14:38:15+00:00","note":"Read reporter issue #896 (afldl, PoC gist public, root cause srp.c step2 only checks A<=0), vulncheck advisory, oss-sec thread, and maintainer commit fb3724f. Fix on master is removal of the SRP plugin (2026-11-12); no release after 2.1.28 found, so no fixed version. SRP default build state unconfirmed (configure.ac truncated); reporter built with --enable-srp. Not marked exploited; no in-the-wild reports found.","cites":["https://github.com/cyrusimap/cyrus-sasl/issues/896"]}],"documents":[{"id":163822,"url":"https://github.com/cyrusimap/cyrus-sasl/commit/fb3724f43dc50247ff2bf02135457d6d77031654","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":163823,"url":"https://www.vulncheck.com/advisories/cyrus-sasl-through-2.1.28-srp-authentication-bypass-via-plugins-srp-c","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"},{"id":163832,"url":"https://github.com/cyrusimap/cyrus-sasl/issues/896","title":"SRP server authentication bypass: A == 0 (mod N) not rejected (#896)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":163833,"url":"https://seclists.org/oss-sec/2026/q4/122","title":"oss-sec: Unfixed vulnerabilities in Cyrus SASL","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}