CVE-2026-86219

Authen::SASL::Perl::DIGEST_MD5 versions before 2.2100 in Perl suffer from an unverified nonce in server_step. The server generates a fresh nonce in server_start but never compares it against the nonce returned by the client; instead, server_step derives the expected digest from the client's own p...