CVE-2020-15074 - OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circumvent the initial token expiry timestamp

Back Back to CVE browser

HIGH

OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circumvent the initial token expiry timestamp

Published Jul 14, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.04%

Description

OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circumvent the initial token expiry timestamp.

Affected products

Vendor n/a Product OpenVPN Access Server Default
unknown
Affected
- 2.8.3 and prior versions in addition to 2.9.5

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	OpenVPN Access Server	unknown	Affected 2.8.3 and prior versions in addition to 2.9.5

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-302

CWE-613

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7202
Advisory
https://openvpn.net/vpn-server-resources/release-notes/
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7202		Advisory
https://openvpn.net/vpn-server-resources/release-notes/		x_refsource_MISCRelease NotesVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner OpenVPN

Published Jul 14, 2020

Updated Aug 4, 2024

Reserved Jun 25, 2020

Link CVE-2020-15074

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-15074

Red Hat

No data

ENISA EUVD

Assigner OpenVPN

Published Jul 14, 2020

Updated Aug 4, 2024

Link EUVD-2020-7202

GitHub

No data