description: OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.
problem types: CWE-305 - Authentication Bypass by Primary Weakness
affected:
{
product: OpenVPN
vendor: n/a
versions:
status: affected, version: version 2.1 until version 2.4.12 and 2.5.6.
}