A 27-Year-Old Authentication Bypass in OpenBSD’s PPP Stack (CVE-2026-55706)

Original text: “A 27-Year-Old Authentication Bypass in OpenBSD’s PPP Stack” — Argus, Argus Blog (2026-06-16). Kernel source snippets and console output below are reproduced verbatim with attribution; the surrounding analysis, the attack-chain diagram and the proof-of-concept are original to core-jmp.org.

Executive Summary

OpenBSD’s synchronous-PPP layer contained a textbook length-confusion bug in its PAP (Password Authentication…

https://core-jmp.org/2026/06/openbsd-ppp-pap-authentication-bypass-cve-2026-55706/