OpenVPN Remote DoS via Malformed Authentication Token

Publication date: 2026-07-06

Last updated on: 2026-07-09

Assigner: OpenVPN Inc.

Description

OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-06

Last Modified

2026-07-09

Generated

2026-07-27

AI Q&A

2026-07-06

EPSS Evaluated

2026-07-25

NVD

CVE-2026-13122

EUVD

EUVD-2026-41880

Affected Vendors & Products

Vendor	Product	Version / Range
openvpn	openvpn	From 2.6.0 (inc) to 2.6.21 (exc)
openvpn	openvpn	From 2.7 (inc) to 2.7.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This vulnerability affects OpenVPN versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. It allows remote attackers to cause a denial of service by sending a malformed authentication token. This malformed token triggers a reachable assertion failure when the external-auth feature is enabled.

Impact Analysis

The primary impact of this vulnerability is a denial of service condition. An attacker can remotely cause the OpenVPN service to crash or become unavailable by exploiting the malformed authentication token issue when external-auth is enabled. This can disrupt VPN connectivity and potentially affect business operations relying on OpenVPN.

Hi! I’m here to help you understand CVE-2026-13122. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70