Insufficient verification of data authenticity in OpenVPN Server - CVE-2025-13086

Vulnerability identifier: #VU118819

CSH Severity: Medium

CVSS v4 BT: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-13086

CWE-ID: CWE-345

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper handling of HMAC verification checks during the three way handshake. A remote attacker can bypass source IP address validation and connect to the server from an IP address that did not initiate the initial connection. 

OpenVPN Server
Debian Linux
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
Basesystem Module
openSUSE Leap
openEuler
Ubuntu
openvpn (Debian package)
openvpn
openvpn-debuginfo
openvpn-debugsource
openvpn-devel
openvpn-help
openvpn-down-root-plugin
openvpn-dco-debuginfo
openvpn-auth-pam-plugin
openvpn-dco-debugsource
openvpn-dco
openvpn-down-root-plugin-debuginfo
openvpn-auth-pam-plugin-debuginfo
openvpn-dco-devel
openvpn (Ubuntu package)

Install updates from vendor's website.

OpenVPN Server - update to 2.6.16
openvpn (Debian package) - addressed in versions 2.6.3-1+deb12u4, 2.6.14-1+deb13u1
openvpn - addressed in versions 2.6.9-5, 2.6.9-6
openvpn-debuginfo - addressed in versions 2.6.9-5, 2.6.9-6
openvpn-debugsource - addressed in versions 2.6.9-5, 2.6.9-6
openvpn-devel - addressed in versions 2.6.9-5, 2.6.9-6
openvpn-help - addressed in versions 2.6.9-5, 2.6.9-6
openvpn-down-root-plugin - update to 2.6.10-150600.3.20.1
openvpn-dco-debuginfo - update to 2.6.10-150600.3.20.1
openvpn-auth-pam-plugin - update to 2.6.10-150600.3.20.1
openvpn-dco-debugsource - update to 2.6.10-150600.3.20.1
openvpn-debuginfo - update to 2.6.10-150600.3.20.1
openvpn-dco - update to 2.6.10-150600.3.20.1
openvpn-down-root-plugin-debuginfo - update to 2.6.10-150600.3.20.1
openvpn-auth-pam-plugin-debuginfo - update to 2.6.10-150600.3.20.1
openvpn-debugsource - update to 2.6.10-150600.3.20.1
openvpn - update to 2.6.10-150600.3.20.1
openvpn-devel - update to 2.6.10-150600.3.20.1
openvpn-dco-devel - update to 2.6.10-150600.3.20.1
openvpn (Ubuntu package) - addressed in versions 2.6.14-0ubuntu0.24.04.3, 2.6.14-0ubuntu0.25.04.3, 2.6.14-2ubuntu1.1

• https://github.com/OpenVPN/openvpn/commit/fa6a1824b0f37bff137204156a74ca28cf5b6f83

• Source IP address validation bypass in OpenVPN server
• Ubuntu update for openvpn
• openEuler 24.03 LTS SP2 update for openvpn
• Debian update for openvpn
• openEuler 24.03 LTS SP1 update for openvpn
• openEuler 24.03 LTS update for openvpn
• SUSE update for openvpn