CVE-2025-58060

HIGH8.0

cups has Authentication bypass with AuthType Negotiate

Published Sep 11, 2025

Modified 2 months ago

No fix available

Details

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the AuthType is set to anything but Basic, if the request contains an Authorization: Basic ... header, the password is not checked. This results in authentication bypass. Any configuration that allows an AuthType that is not Basic is affected. Version 2.4.13 fixes the issue.

References

WEBhttp://www.openwall.com/lists/oss-security/2025/09/11/1 WEBhttps://github.com/OpenPrinting/cups/commit/595d691075b1d396d2edfaa0a8fd0873a0a1f221 WEBhttps://github.com/OpenPrinting/cups/security/advisories/GHSA-4c68-qgrh-rmmq WEBhttps://lists.debian.org/debian-lts-announce/2025/09/msg00013.html ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-58060

CVSS Analysis

CVSS v3.1

8.0

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

HighI:H

Availability

HighA:H

8/CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Weakness Type (CWE)

Authentication

CWE-287

Improper Authentication

Ecosystems

Timeline

PublishedSep 11, 2025

ModifiedNov 4, 2025