CVE-2020-15074

Published: Jul 14, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circumvent the initial token expiry timestamp.

Affected (2)

Products: Openvpn: Openvpn Access Server

Openvpn

1 product

Openvpn Access Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Openvpn Openvpn Access Server	Before 2.8.4
Openvpn Openvpn Access Server	From 2.9.0 to 2.9.6

Related CWEs

CWE-302

Authentication Bypass by Assumed-Immutable Data

The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be controlled or modified by the attacker.

CWE-613

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (2)

https://openvpn.net/vpn-server-resources/release-notes/

Source: security@openvpn.net

Release NotesVendor Advisory

https://openvpn.net/vpn-server-resources/release-notes/

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.