CVE-2025-58060

HIGH8.0

cups has Authentication bypass with AuthType Negotiate

Published Sep 11, 2025

Modified 4 months ago

Details

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the AuthType is set to anything but Basic, if the request contains an Authorization: Basic ... header, the password is not checked. This results in authentication bypass. Any configuration that allows an AuthType that is not Basic is affected. Version 2.4.13 fixes the issue.

References

WEB

http://www.openwall.com/lists/oss-security/2025/09/11/1

WEB

https://github.com/OpenPrinting/cups/commit/595d691075b1d396d2edfaa0a8fd0873a0a1f221

WEB

https://github.com/OpenPrinting/cups/security/advisories/GHSA-4c68-qgrh-rmmq

WEB

https://lists.debian.org/debian-lts-announce/2025/09/msg00013.html

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2025-58060

CVSS Analysis