CVE-2026-13122
Received Received - Intake

OpenVPN Remote DoS via Malformed Authentication Token

Publication date: 2026-07-06

Last updated on: 2026-07-06

Assigner: OpenVPN Inc.

Description
OpenVPN version 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers to cause a denial of service via a malformed authentication token that triggers a reachable assertion when external-auth is enabled

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-06
Last Modified
2026-07-06
Generated
2026-07-06
AI Q&A
2026-07-06
EPSS Evaluated
N/A
NVD
CVE-2026-13122
EUVD
EUVD-2026-41880

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openvpn openvpn From 2.6.0 (inc) to 2.6.20 (inc)
openvpn openvpn From 2.7_alpha1 (inc) to 2.7.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects OpenVPN versions 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4. It allows remote attackers to cause a denial of service by sending a malformed authentication token. This malformed token triggers a reachable assertion failure when the external-auth feature is enabled.

Impact Analysis

The primary impact of this vulnerability is a denial of service condition. An attacker can remotely cause the OpenVPN service to crash or become unavailable by exploiting the malformed authentication token issue when external-auth is enabled. This can disrupt VPN connectivity and potentially affect business operations relying on OpenVPN.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart