CVE-2019-19521: libc in OpenBSD 6.6 allows authentication bypass via the -schallenge username, as demonstrated by smtpd, ld...

Security readout for executives and security teams

OpenBSD 6.6 had an authentication bypass in libc. A specially formed username could cause some authentication paths to succeed incorrectly, with smtpd, ldapd, and radiusd cited as examples. For organizations still running OpenBSD 6.6, this is urgent because it affects trust boundaries around login or service authentication. Exposure is most likely on OpenBSD 6.6 systems using affected libc authentication flows, especially systems running smtpd, ldapd, radiusd, login, or xenodm paths named in the CVE. The supplied record does not identify other versions or products. Prioritize remediation for any remaining OpenBSD 6.6 systems, especially internet-facing or remote-authentication services. This is an authentication bypass in a core library, so delayed patching creates disproportionate access risk. Mitigation focus: Apply the OpenBSD 6.6 security errata for this authentication issue.; Upgrade affected OpenBSD systems following vendor guidance where patching is impractical.; Limit exposure of affected authentication services until remediation is complete..

Prepared

Jun 6, 2026, 03:53 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.