Threats tagged 'ghsa-h9fw-9v74-m2cr'

Cyrus SASL versions through 2.1.28 have an authentication bypass vulnerability in the SRP server mechanism. The flaw occurs because the server does not reject certain client public values, allowing unauthenticated clients to authenticate as any user without a password. This vulnerability can lead to full compromise of confidentiality and integrity of sessions.