CVEvulnerability
CVE-2025-58060
8.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2025-09-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.0 HIGH — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
- Weaknesses
- CWE-287
Description
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.12 and earlier, when the `AuthType` is set to anything but `Basic`, if the request contains an `Authorization: Basic ...` header, the password is not checked. This results in authentication bypass. Any configuration that allows an `AuthType` that is not `Basic` is affected. Version 2.4.13 fixes the issue.
Affected configurations
• openprinting cups (< 2.4.13)
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://github.com/OpenPrinting/cups/commit/595d691075b1d396d2edfaa0a8fd0873a0a1f221 Patch
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-4c68-qgrh-rmmq Exploit, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/09/11/1 www.openwall.com
- https://lists.debian.org/debian-lts-announce/2025/09/msg00013.html lists.debian.org