CVE-2026-27855

Dovecot OTP authentication is vulnerable to a replay attack under specific conditions: if auth cache is enabled and the username is altered in passdb, OTP credentials can be cached so that the same OTP response remains valid. An attacker who observes an OTP exchange can log in as the targeted use...

CVE-2026-27855

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If...

UBUNTU-CVE-2026-27855

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If...

Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by Netty CRLF injection vulnerability, SCRAM authentication vulnerability, Hibernate Reactive database connection leak vulnerability and Quarkus REST worker thread exhaustion vulnerability. Vulnerability Details CVEID:CVE-2025-14969 DESCRIPTION:...

ongres-scram: Timing Attack Vulnerability in SCRAM Authentication

A timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many...

ongres-scram: Timing Attack Vulnerability in SCRAM Authentication

A timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many...

Moderate: Red Hat Security Advisory: Red Hat build of Quarkus 3.20.5 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more information...

kafka: Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption

A flaw was found in Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM, which did not fully adhere to the requirements of RFC 5802. Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the...

SUSE: Security Advisory (SUSE-SU-2025:21016-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE 16 Security Update : ongres-scram (openSUSE-SU-2025-20059-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2025-20059-1 advisory. - CVE-2025-59432: Fixed timing attack vulnerability in SCRAM Authentication bsc1250399 Tenable has extracted the preceding description block directly fr...

Security update for ongres-scram (important)

openSUSE security update: security update for ongres-scram ------------------------------------------------------------- Announcement ID: openSUSE-SU-2025-20059-1 Rating: important References: bsc1250399 Cross-References: CVE-2025-59432 CVSS scores: CVE-2025-59432 SUSE : 6.8...

OPENSUSE-SU-2025:20059-1 Security update for ongres-scram

This update for ongres-scram fixes the following issues: - CVE-2025-59432: Fixed timing attack vulnerability in SCRAM Authentication bsc1250399...

SUSE-SU-2025:21016-1 Security update for ongres-scram

This update for ongres-scram fixes the following issues: - CVE-2025-59432: Fixed timing attack vulnerability in SCRAM Authentication bsc1250399...

SUSE SLES15: ongres-scram / ongres-scram-client / ongres-scram-javadoc / etc (SUSE-SU-2025:4054-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:4054-1 advisory. - CVE-2025-59432: Fixed timing attack vulnerability in SCRAM Authentication bsc1250399 Tenable has extracted the preceding...

openSUSE Security Advisory (SUSE-SU-2025:4054-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security update for ongres-scram

This update for ongres-scram fixes the following issues: CVE-2025-59432: Fixed timing attack vulnerability in SCRAM Authentication bsc1250399 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you c...

SUSE-SU-2025:4054-1 Security update for ongres-scram

This update for ongres-scram fixes the following issues: - CVE-2025-59432: Fixed timing attack vulnerability in SCRAM Authentication bsc1250399...

ongres-scram-3.2-7.1 on GA media (moderate)

ongres-scram-3.2-7.1 on GA media Announcement ID: openSUSE-SU-2025:15680-1 Rating: moderate Cross-References: CVE-2025-59432 CVSS scores: CVE-2025-59432 SUSE : 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N CVE-2025-59432 SUSE : 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:...

OPENSUSE-SU-2025:15680-1 ongres-scram-3.2-7.1 on GA media

These are all security issues fixed in the ongres-scram-3.2-7.1 package on the GA media of openSUSE Tumbleweed...

Timing Attack

com.ongres.scram:scram-common is vulnerable to Timing Attack. The vulnerability is due to the use of Arrays.equals for comparing sensitive authentication values, which performs short-circuit evaluations and causes variable execution times, allowing an attacker to exploit timing differences to inf...